Running Wazuh is only the first step. The real work starts after the alerts arrive.

This bundle gives you 7 practical Wazuh automation workflows for alert investigation, threat hunting, vulnerability reporting, agent monitoring, rule tuning, and security reporting.

Instead of building everything from scratch, import the workflows into n8n and start automating your SOC.

What's included

🛡️ Wazuh UEBA Automation

Build 30-day behavioral baselines and detect unusual activity across users and hosts.

📊 Monthly Wazuh Reports

Automatically create technical and executive security reports from your Wazuh data.

❤️ Wazuh Agent Health Monitor

Know when an agent disconnects or stops reporting, with automatic alerts and escalation.

⚙️ Wazuh Rule Tuning

Safely test and approve rule changes with an approval-based n8n workflow.

🔐 Weekly Vulnerability & Patch Reports

Turn Wazuh vulnerability data into clear weekly reports with risk-based prioritization and patch recommendations.

🤖 AI SOC Analyst L1

Automatically investigate Wazuh alerts, enrich indicators, analyze them with AI, and create incident reports.

🎯 Wazuh Threat Hunter

Run 59 MITRE ATT&CK-mapped threat hunts automatically and receive analyst-ready findings.

Why get the bundle?

• 7 workflows instead of building them one by one
• Ready to import into n8n
• Designed specifically for Wazuh
• Automate repetitive SOC tasks
• Use local AI where supported
• Customize the workflows for your environment
• Includes setup guides and documentation

Built for

SOC teams · MSSPs · MSPs · Security consultants · Wazuh administrators · Security homelabs

One bundle. 7 Wazuh automations. A more automated SOC.

Import the workflows, connect your Wazuh instance, and start automating.

Need help?

Want help deploying or customizing it? Get deployment & customization