Wazuh Rule Tuning Automation — Approval-Gated n8n Workflow, 81 Nodes

Automatically tune your noisiest Wazuh rules without letting a script touch your ruleset on its own.

One n8n workflow. It profiles your alert noise every night, asks a local LLM how to quiet it, validates every suggestion against your real ruleset, and writes nothing until you click Confirm. Backup and automatic rollback included.

A handful of rules generate most of your Wazuh noise. One sshd rule fires thousands of times off a single scanner. Active-response events flood the console. A certbot lock file trips FIM on every renewal.

You know none of it is a real threat. But writing the exception, picking a safe rule ID, testing it with logtest, and not breaking three other rules takes focus you don't have on a Tuesday. So the noise stays and real alerts hide inside it.

What it does

• Finds the noise — one aggregation query per scope pulls your loudest rules, with concentration by agent, source IP, and user.
• Proposes the fix — a local LLM (Ollama) suggests a CDB list, a child exception, or a level override or says "leave it, that's real activity."
• Proves it's safe — every proposal passes a code guard (ID collisions, XML whitelist, dead-rule protection) and a live logtest against your actual manager. Bad ones are dropped with a reason.
• Waits for you — the change is delivered as a report. In apply mode, nothing is written until you open a link and press Confirm.
• Cleans up after itself — backs up the file before every write, re-tests after, and rolls back automatically if anything breaks.

Video DemoWhy it won't wreck your ruleset

This is the part that matters, because the workflow writes to production.

1. Ships in report mode. Out of the box it only analyzes. It cannot write to Wazuh until you deliberately change one setting.
2. The AI never decides. Its suggestions pass deterministic code checks and a live logtest before you even see them.
3. Two human clicks to apply. The approval link opens a confirmation page; only the button on that page acts. Link crawlers and browser prefetch can't trigger it.
4. Every change is reversible. Backup before, smoke test after, automatic rollback on failure.
5. It never restarts your manager. You stay in control of when changes go live.

How it works

1. Import the workflow and add four credentials (Wazuh Manager, Wazuh Indexer, Ollama, Discord).
2. Fill in one CONFIG node — URLs and your preferences. Nothing else holds settings.
3. Run it in report mode and read the nightly report.
4. When you trust it, switch to apply mode and approve changes from Discord.

About 20 minutes to your first report.

What you get

• The workflow (81 nodes), import-ready, credentials stripped
• Setup guide, full configuration reference, and a sample report
• Single-organization commercial license use it for your own estate or your clients'

Requirements

• n8n v1.x+ at a reachable URL
• Wazuh Manager API + Indexer reachable from n8n
• An Ollama endpoint (runs local, your logs never leave your network) Or use Cloud models API
• A Discord webhook (Slack/Gmail/Telegram swappable)

Who it's for

SOC engineers and MSPs running Wazuh who want less noise and a safe, auditable way to get it — not a black box that edits rules behind their back.

License

Buy once, use forever, in one organization. Run it for your own clients as a managed service. You may not resell or republish the workflow itself.