Wazuh UEBA Automation – 30-Day Behavioral Baselines & Anomaly Reports

Your SIEM is very good at catching what someone wrote a rule for. It is blind to everything else.

It will not tell you that svc-backup has never logged in from that country before. That WEB-01 just tripped a MITRE tactic it has never tripped in a month. That an account acquired sudo for the first time on Tuesday. That a host has quietly stopped sending logs since Friday.

That gap is called UEBA, and the products that fill it want six figures, their own data lake, and a quarter of your year.

This is the pragmatic version. One n8n workflow builds a 30-day behavioral baseline for every user and every host in your Wazuh estate, compares yesterday against it across 18 dimensions, scores and ranks every entity that misbehaved, and emails you one report every morning.

It runs entirely on the alert data already sitting in your Wazuh Indexer. No database. No agent. No extra licence. No state to corrupt. Import the JSON, attach two credentials, run.

What makes it actually work

• Robust detection, not averages. Uses median + MAD modified z-scores, so long-running attacks don't inflate the baseline and hide themselves.
• Entity risk scoring. Correlates anomalies by user or host, combining multiple signals into a single prioritized risk score.
• Impossible travel, no external APIs. Detects unrealistic login locations using Wazuh GeoLocation data only. If GeoIP isn't enabled, it automatically skips this check.
• Resilient AI triage. Local Ollama explains anomalies and recommends next steps. If AI is unavailable, built-in analyst guidance ensures reports are still generated.
• Finds visibility gaps. Reports the status of all 18 detection dimensions, exposing missing telemetry before it becomes a problem.
• Client-ready reports. Generates clean, professional reports with posture summaries, severity breakdowns, ranked entities, and clear findings—fully white-labelable.
• Safe by default. Runs in DRY_RUN mode to preview reports inside n8n before sending anything.

Import the JSON, attach your credentials, run. First report in ~15 minutes.

What's inside

• ✅ Complete n8n workflow (23 nodes, import-ready, credential-free — Gmail and SMTP delivery both pre-wired)
• ✅ Step-by-step setup guide — ~15 minutes to your first report
• ✅ Full configuration reference — every knob, every threshold, what to change when it's noisy
• ✅ Detection library — all 18 dimensions with logic, required telemetry, MITRE mapping and documented false positives
• ✅ Two sample reports you can open in your browser right now: a real detection run, and a normal quiet day
• ✅ Bonus: first-week tuning playbook, MSP multi-tenant recipes, client-facing copy, and power-user extensions

Built for

SOC teams who want behavioral coverage without a second platform · MSPs adding a premium recurring deliverable · security consultants who need a differentiator on top of Wazuh · homelabbers who want enterprise-grade detection output.

Requirements

n8n (self-hosted or cloud) · Wazuh 4.x with the Wazuh Indexer · ~30 days of alert history · Gmail or any SMTP (both transports ship pre-wired). Ollama optional. Zero external API keys — nothing leaves your network but the email.

Guarantee

If the workflow doesn't import cleanly or the nodes don't work as described, reach out and I'll fix it or refund it — no questions.