Cybersecurity Automation Blog
Tactical guides on n8n cybersecurity workflows, AI SOC analysts, threat intel automation, and incident response, built for analysts who ship in production.
- What Automation Actually Does to a SOC Team [Impact] · 2026-09-01 · About a quarter of security alerts are never investigated, and 60% of teams have had one of those turn into a real incident. Here is what changes when you automate the work, with real numbers.
- n8n Cybersecurity Automation That Does Not Die in Six Months [Insights] · 2026-08-29 · We build security automation for any SIEM, then keep it alive for you
- CTI AI Agent Update: The Before/After of Improving an n8n Workflow for Production [Threat intelligence] · 2026-08-18 · 10 concrete changes, keys out of code, one agent for every IOC type, and the two n8n traps that fail silently.
- Wazuh Rule Tuning Automation Approval-Gated n8n Workflow, 81 Nodes [Rule Tuning] · 2026-08-13 · I let an AI tune my Wazuh rules but only if it asks permission first
- I Automated Threat Hunting on Wazuh with n8n - Here's the Workflow, Node by Node [Threat Hunting] · 2026-07-28 · 31 nodes that run 59 MITRE-mapped hunts every Monday, triage the hits with a local AI, and email one report that opens with the verdict.
- One Wazuh, Many Clients: Why I Built a Multi-Tenant Wazuh Dashboard [Tool] · 2026-07-21 · Wazuh has no clean way to give each client their own view. Here's how I built a multi-tenant Wazuh dashboard with white-label logins without touching the SIEM.
- The Practical Guide to Cybersecurity Automation with Local AI Models [Guide] · 2026-06-30 · After Reading this guide you will understand why local AI matters for security, which models to run, how to run them, how to wire them into n8n, and exactly how to tune them.
- How to Automate a Wazuh Monthly Report (Technical + Management PDFs, Zero Manual Work) [Reporting] · 2026-06-20 · Build an automated Wazuh monthly report in n8n - technical + management PDFs, real charts, MITRE mapping, emailed every month with zero hardcoded data
- AI SOC Agent Pro Edition - Stop Triaging SIEM Alerts Manually [Detection] · 2026-06-17 · I built a 73-node n8n workflow that turns Wazuh alerts into AI-generated incident reports. It runs 100% locally with Ollama
- Deploy Wazuh SIEM at Enterprise Level: Multi-Node Architecture on Ubuntu [Detection] · 2026-06-15 · Build a scalable, enterprise-grade Wazuh deployment with dedicated Indexer, Manager, and Dashboard nodes - the same architecture used to monitor 850+ endpoints in production
- I Spent Days Trying to Break AI Chatbots. Then I Built a Tool That Does It in 5 Minutes. [Pentesting] · 2026-06-05 · Meet the AI Chatbot Security Testing Tool - the fastest way to find out if your assistant is leaking secrets
- I Built an AI SOC Analyst in n8n That Triages Wazuh Alerts For Me - Here’s Every Node, Explained [AI Agent] · 2026-05-31 · How a webhook, a local LLM, and a healthy fear of auto-blocking my own servers turned into a 24/7 tier-1 analyst.
- Automatically Detect New Cyber Threats Before Your Team Reads the News [News] · 2026-05-18 · Stop Scrolling Cybersecurity News: Let This AI Send You Only the Threats That Matter
- Integrating FortiGate Logs with Wazuh [Detection] · 2026-05-05 · Complete Security Monitoring Setup
- AI CTI Agent: Delivers Report & STIX 2.1 Bundles [Automation] · 2026-05-04 · Most CTI workflows are a mess. You get an alert. You copy an IP. You paste it into VirusTotal. You open another tab for AbuseIPDB. You manually check OTX. You try to remember the MITRE technique from…