Building a Local AI Cybersecurity News Briefing
A practical proof of concept combining n8n automation, live cybersecurity RSS feeds, an Ollama-hosted language model, and Telegram delivery to generate a SOC-oriented news briefing with local inference.
Project overview
Security operations teams need to keep up with emerging vulnerabilities, threat activity, and defensive guidance. Manually reviewing news feeds is repetitive, while asking a standalone language model for “the latest news” can produce outdated or fabricated answers. This project explored a lightweight way to retrieve current source material first, use a local model to summarise it, and deliver the results automatically.
Useful, low-cost briefings
Build an end-to-end automation that converts security news into short summaries suitable for a SOC manager, with enterprise impact, suggested defensive action and a source URL.
Ground the model in evidence
Provide the model with actual RSS article fields instead of relying on its training knowledge or assuming it can browse the web.
Architecture
Conceptual workflow based on the implemented PoC. RSS retrieval supplies current material; the model itself does not perform live web searches in this flow.
n8n + Telegram
n8n coordinates feed retrieval, item limiting, model calls, consolidation and delivery. A Telegram bot sends the final briefing to a chat.
Ollama + Qwen3
Ollama serves qwen3:8b from a Windows PC. The model turns the supplied article data into SOC-oriented summaries without an OpenAI inference API call.
Technology and hardware
Inference workstation
- Windows PC
- AMD Ryzen 7 5800X (8 cores)
- 64 GB system RAM
- AMD Radeon RX 7600 XT (16 GB VRAM)
- Ollama 0.40.3 at time of testing
Application stack
- n8n workflow automation
- Ollama local model server
- Qwen3 8B language model
- The Hacker News RSS feed (initial source)
- Telegram bot for message delivery
The ollama ps command showed qwen3:8b loaded at approximately 5.6 GB, 100% GPU, with a 4,096-token active context allocation. This confirmed GPU-backed inference for the tested model configuration.
ollama ps
NAME SIZE PROCESSOR CONTEXT
qwen3:8b 5.6 GB 100% GPU 4096Implementation walkthrough
Connect n8n to local Ollama
Configured n8n's Ollama credential and selected the installed qwen3:8b model in the “Message a Model” node. Verified the model was being processed on the Radeon GPU.
Retrieve current security articles
Used an RSS Read node against The Hacker News feed. In the observed execution, the feed returned 50 items including titles, publication dates, links and article snippets.
Control the initial workload
Inserted a Limit node to reduce the first test to three articles. This kept inference time and output volume manageable while validating the workflow.
Ground the model prompt in RSS data
Passed the article title, ISO publication date, source URL and content snippet to the model using n8n expressions. Instructed the model to produce a headline, summary, enterprise impact, recommended SOC action and source reference, without inventing facts.
Consolidate the model outputs
Added a Code node to combine individual article summaries into one briefing message, including the briefing date and a reminder to verify AI-generated findings against the original sources.
Deliver to Telegram
Created a Telegram bot, configured the n8n Telegram node and sent the consolidated briefing to a Telegram chat. Successful message delivery completed the end-to-end PoC.
Problems encountered and resolved
Outdated “latest news” answers
A direct prompt to Qwen3 returned events from 2021–2023 and presented unverified claims. Resolution: retrieve current RSS material in n8n and pass it explicitly to the model.
Unresolved prompt variables
An early n8n execution produced literal placeholders such as $json.title and generic summaries. Resolution: switch the Content field to Expression mode and verify that article values are interpolated before execution.
Too many items for a first test
The initial RSS response contained 50 items, potentially triggering 50 inference calls. Resolution: add a Limit node and test with three articles before expanding.
Trust and verification
Even with supplied sources, a model can infer unsupported implications. Mitigation: constrain the prompt, retain source links and mark output as AI-generated. Human verification remains necessary.
Proof-of-concept outcome
End-to-end delivery achieved
The working workflow retrieves cybersecurity news from RSS, summarises a limited selection with a locally hosted Qwen3 model, consolidates the outputs, and sends a briefing via Telegram. The test demonstrated local GPU inference and delivery without requiring paid OpenAI API inference.
Scope note: This is a functional PoC, not a production threat-intelligence platform. It does not yet establish fact-checking, deduplication across runs, comprehensive source coverage, incident severity scoring or guaranteed delivery. The model's analysis should not be treated as verified threat intelligence.
Suggested screenshots
These placeholders are intentionally left for screenshots from the actual environment; no screenshots have been fabricated.
ollama ps output with Qwen3 running 100% on GPU.Potential future enhancements
News quality and coverage
- Filter to a rolling 24-hour publication window
- Track previously sent article URLs to prevent repeats
- Aggregate multiple reputable security RSS sources
- Rank items for SOC operational relevance
Operational usability
- Format Telegram messages with concise sections and links
- Handle Telegram's message-length constraints
- Add error handling and workflow execution alerts
- Experiment with an interactive, access-controlled Telegram bot