We would notice if Wazuh broke

We did not. Our own n8n integration was failing 28 times a day, with nothing to say so

Three things, each with your approval and in dry run first: replicas to 0 on a single-node cluster, a retention policy for wazuh-alerts-*, and deleting alert indices older than a cutoff

Can it delete my alerts?

Only old indices you approve, and never alerts younger than 30 days by default

Does it need write access?

No. Read access is enough for every check. Index management is needed only if you want it to apply fixes

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Which AI model does it need?

An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

Quiet does not mean safe. Make sure Wazuh is working

The worst Wazuh outages are silent: a full disk, the shard limit, a stalled pipeline, a failing integration. It checks all of it and tells you what is wrong and how to fix it

Platform Engineer: $99.99, one-time. Product details

When Wazuh breaks, the dashboards just go quiet

Before: A full disk or the shard limit stops new alerts
Before: A failing integration drops alerts without a sound
Before: Nobody reads the manager log until something burns
After: Indexer, pipeline and manager checked, worst first
After: Days of disk runway and shard headroom, before they run out
After: Errors grouped, with a likely cause and a fix

A Wazuh admin on call every day

Health check: Cluster colour, disk vs the watermarks, JVM heap, shards vs the limit, unassigned shards and retention, worst first
Pipeline: How old the newest alert is, so a stalled pipeline never looks like a calm day
Manager: Core daemons, analysisd drops and queue usage, remoted and config validation
Failing integrations: Alerts that are not being forwarded, and how often
Storage and capacity: Size per index family, daily growth, days of runway and the retention that would fit
Ingestion: Alerts per hour with gaps, noisy agents, top rules, and events received, processed and dropped
Log triage: Errors and warnings grouped, with a likely cause for known patterns
Upgrade check: The manager vs the latest Wazuh release, agent versions and unsupported combinations
Fixes with approval: Replicas to 0 on a single node, a retention policy, or old alert indices deleted, all in dry run first

One command, about ten minutes

Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
Connect: Add a Wazuh indexer user with cluster monitoring, a read-only Manager API user, your chat app and an AI model key
Ask: Ask if Wazuh is healthy. The daily platform check starts on its own

What you need

n8n: n8n 2.34 or newer with Agents, or let the installer deploy it
Indexer: A user with cluster monitoring and read access. Index management only if you allow fixes
Manager API: Read access is enough
Chat app: Telegram, Slack, Discord or Linear. A Telegram bot takes a minute with @BotFather
AI model: An API key from any provider in the n8n Agent model picker

Careful with the platform your SOC depends on

Read-only by default. Only the cleanup tool changes anything, and it waits for your approval every time

Approval every time: Cleanup needs an Approve click and starts in dry run
Says what is reversible: Each change explains whether it can be undone before you approve it
Recent alerts protected: It never deletes alerts younger than 30 days by default
Honest diagnosis: Statuses come from the indexer and the Manager API. Likely causes are labelled as hints
Data, not instructions: Log lines and index names are never treated as commands
Short when healthy: Three lines on a good day, the full story when something is wrong

What you get

7 tool workflows and the daily platform check
The agent with 5 skills: daily check, storage and retention, pipeline troubleshooting, log triage and fixes with approval
One-command installer for Linux, macOS and Windows
Setup guide and example conversations
Single-organization commercial license
7-day money-back guarantee

Common questions

We would notice if Wazuh broke: We did not. Our own n8n integration was failing 28 times a day, with nothing to say so
What can it fix?: Three things, each with your approval and in dry run first: replicas to 0 on a single-node cluster, a retention policy for wazuh-alerts-*, and deleting alert indices older than a cutoff
Can it delete my alerts?: Only old indices you approve, and never alerts younger than 30 days by default
Does it need write access?: No. Read access is enough for every check. Index management is needed only if you want it to apply fixes
Does it only work in Telegram?: No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in
Which AI model does it need?: An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google
What if it is not for me?: You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents