SOC Analyst L1 Agent (No-AI) For Wazuh SIEM

An n8n workflow that turns raw Wazuh alerts into finished incident reports verdict, false-positive call, severity, MITRE technique, and a response playbook without a single line going to an LLM.

No Ollama, no OpenAI key, no GPU, no tokens. It talks to Wazuh over the REST API only (no SSH), enriches any indicator type via VirusTotal + AbuseIPDB, delivers to every channel you want at once, and can auto-block malicious IPs behind a five-way safety gate that ships in dry-run.

Who it's for

• MSSPs and in-house SOCs who want tier-1 triage automated but won't (or can't) run an AI model over customer alert data.
• Air-gapped / regulated environments where "no data leaves the network for a model" is a hard requirement.
• Teams that want explainable triage — every verdict traces to a rule you can point at, not a black box.

What makes it different

• No AI, by design. The report is written by a deterministic engine. It's instant, free to run, identical every time for the same input, and fully auditable. Alert contents never touch a model.
• Every IOC type, not just IPs. File hashes, URLs, domains and IPs are all extracted and sent to the matching VirusTotal endpoint. A malware FIM alert gets a file-reputation lookup; a web alert gets a URL lookup.
• Safe out of the box. Auto-blocking is gated by dry-run + master switch + IP/CIDR whitelist + VirusTotal threshold + minimum rule level. All five must agree. Dry-run ships on.
• Delivers everywhere at once. Discord, Slack, Telegram and Email (SMTP or Gmail) in parallel — a dead channel can't stop the others. Email goes out as a designed HTML report with three swappable templates.
• Production hardened. Input sanitization against command injection, stateful deduplication so a brute-force burst is one report not two hundred, and a self-reporting error handler.

Video Demo

What you get

• The n8n workflow JSON (import and go)
• Three realistic Wazuh test alerts (IP, file-hash and Windows-login shapes)
• A browser-openable sample report
• Three drop-in HTML email templates + a field reference
• Step-by-step setup guide (~10 minutes to live), full configuration reference, and license

Requirements

• n8n v1+
• Wazuh Manager & Indexer (REST API)
• Free VirusTotal & AbuseIPDB API keys
• At least one notification channel

Guarantee

If the workflow doesn't import cleanly or the nodes don't work as described, reach out and I'll fix it or refund it — no questions.

Related

Want an LLM to write the narrative instead of rules? See AI SOC Analyst L1 For Wazuh

Need live log pull over SSH and ufw blocking? See AI SOC Analyst L1 (multi-VM SSH edition).