You are helping me build the following AI agent workflow.

## Goal
SIEM Alert Enrichment with MITRE ATT&CK: Ingests raw SIEM alerts, enriches them with MITRE ATT&CK TTPs via vector search.

## Specification
- What it does: You receive enriched SIEM alerts that automatically link raw incidents to MITRE ATT&CK Tactics, Techniques, and Procedures via vector search. This process generates specific remediation steps and updates your Zendesk tickets with contextual threat intelligence so SOC teams can act immediately.
- Trigger: Triggered by an event (Event · on new SIEM alert)
- Autonomy: Fully hands-off
- Expected setup effort: a few focused days
- Tools/services involved:
  - n8n: Workflow orchestration
  - Zendesk: Ticket enrichment and updates
  - Qdrant Vector Store: Storing and retrieving MITRE ATT&CK data
  - OpenAI Chat Model: Generating remediation steps and extracting TTPs

## Known pitfalls, handle each one explicitly in your implementation
1. Vector search may return irrelevant techniques if the alert text is too sparse, so add a minimum similarity score threshold to filter results.
2. Token usage costs can escalate with large alert bodies, truncate or summarize raw alert payloads before sending them to the OpenAI API.

## Reference implementation
https://n8n.io/workflows/2840 (workflow template)
Fetch and inspect this before building. If it matches my stack, adapt it;
if not, rebuild the pattern with my tools.

## Process requirements
1. Before building: ask me which of the listed tools I actually use and
   what my platform is (n8n / Make / code / other). Do not assume.
2. Adapt the pattern to my answers; do not force the reference stack.
3. Address every pitfall above; tell me how you handled each.
4. Provide a test plan I can run before letting this touch real data.
5. Ask before any step that sends messages, modifies data, or spends money.

Source: https://usecasesforagents.com/use-case/automate-siem-alert-enrichment-with-mitre-att-ck/ via usecasesforagents.com