NeetroX - AI Agents for SOC Teams
Self-hosted AI agents for Wazuh SOC teams: alert triage, threat hunting, incident response and compliance in your team chat, plus n8n security workflows.
AI agents
- Wazuh Copilot: An AI SOC analyst that watches Wazuh and answers you in chat
- Incident Response Commander: Your AI incident lead in chat, from the first alert to the post-incident report
- Threat Hunter: Hunts your Wazuh data for the attackers your alerts missed
- Phishing Analyst: Checks every reported email, finds out who clicked and thanks the reporter
- Threat Intel Analyst: Tells you if an IP, domain or hash is bad, and whether it already touched your network
- Detection Engineer: Tunes your noisy Wazuh rules and writes new ones, tested before they go live
- Vulnerability Manager: Turns thousands of Wazuh CVEs into a short, prioritized patch list
- Compliance Auditor: Shows where you stand on PCI DSS, ISO 27001, SOC 2 and more, from evidence Wazuh already collects
- SOC Manager: Writes the shift handover, tracks what is overdue and shows where you are blind
- Platform Engineer: Keeps Wazuh healthy, so your security never goes blind without you knowing
Workflows
- AI SOC Analyst L1 — Wazuh + OpenCTI · $29.00 [automation] · Stop paying a trained analyst to paste IP addresses into VirusTotal Level 12 fires. Someone opens the alert, copies the source IP, checks VirusTotal, checks AbuseIPDB, searches Op…
- Phishing Email Analyzer — Instant Report Edition · $29.00 [automation] · Turn “Is this email phishing?” into a clear analyst report in under a minute. Stop spending 20 minutes manually checking email headers, suspicious links, attachments, and sender d…
- Wazuh Rule Tuning Automation - Approval-Gated, 81 Nodes · $49.00 [automation] · Automatically tune your noisiest Wazuh rules without letting a script touch your ruleset on its own. One n8n workflow. It profiles your alert noise every night, asks a local LLM h…
- SOC Analyst L1 for Wazuh - Rule-Based, No AI · $29.00 [automation] · An n8n workflow that turns raw Wazuh alerts into finished incident reports verdict, false-positive call, severity, MITRE technique, and a response playbook without a single line g…
- Wazuh UEBA Automation - 30-Day Baselines and Anomaly Reports · $29.00 [automation] · Your SIEM is very good at catching what someone wrote a rule for. It is blind to everything else. It will not tell you that svc-backup has never logged in from that country before…
- Automated Threat Hunting for Wazuh - n8n Workflow · $29.00 [automation] · Automated Threat Hunting for Wazuh Threat hunting keeps losing to the alert queue. Not because it's difficult, but because it requires a senior analyst and a free afternoon and th…
- Wazuh Multi-Tenant Client Dashboard · $99.00 [tools] · The White-Label Wazuh Console: Give Every Client Their Own SOC Dashboard, Live in One Afternoon Picture your next client meeting Your client opens a link with your logo on it. The…
- Wazuh Vulnerability Reports - Enriched, Not a Spreadsheet · $19.00 [automation] · Stop copying CVEs into spreadsheets every Monday. Turn your Wazuh vulnerability data into a prioritized patch plan and client-ready report automatically every week. What it does P…
- Monthly Wazuh Reports - Technical and Management PDFs · $19.00 [automation] · Stop spending hours turning Wazuh data into client-ready reports. Automatically turn a full month of Wazuh data into two polished PDF reports — one for security teams and one for …
- AI Chatbot Security Testing - Jailbreaks and Leaks · $19.00 [automation] · Find out how your AI chatbot holds up before attackers do. Run 49 structured attack tests across 16 categories against your chatbot and get a clear, OWASP-mapped security report s…
- AI SOC Analyst L1 for Wazuh - Triage and Incident Reports · $29.00 [automation] · Your Wazuh alerts get investigated and written up before you open your laptop One n8n workflow does the tier-1 job for you: it pulls the context from your Indexer, checks the IP a…
- Vendor Radar - Security Background Check for Any SaaS · $19.00 [automation] · Know the security risk before you trust a new SaaS vendor. Stop relying on a vendor's homepage or a SOC 2 badge alone. Vendor Radar turns a company's domain into a structured secu…
- CVE Explainer and PoC Fetcher - One Lookup, Not Four · $19.00 [automation] · You search the same CVE in four different places. Every time. You get a CVE ID - from a scanner, a Slack alert, a vendor advisory, whatever. Then the tab-hopping starts. NVD for t…
- AI Cybersecurity News Digest - 9 Feeds, One Daily Brief · $19.00 [automation] · You follow 9 security news sites. You read none of them. This workflow reads them all and tells you the one thing that matters today You know the feeling. Ten browser tabs open. T…
- CVE Stack Monitor - CVE Alerts for Your Actual Stack · $29.00 [automation] · CVE Stack Monitor - Know Exactly Which CVEs Are Attacking Your Infrastructure Automatically. Enterprise CVE intelligence platforms cost $200–$2,000/month. This workflow does the s…
- CTI Workflow - IOC Enrichment with STIX and MITRE Mapping · $29.00 [automation] · Send one indicator. Get a cited verdict, a STIX bundle, and MITRE mapping back in under a minute. The CTI AI Agent enriches any IP, domain, URL, hash, or CVE across six intelligen…
Latest from the blog
- SOAR, DIY n8n, or Managed: Which Is Right for Your SOC? [Insights] · 2026-10-26 · A commercial SOAR, your own n8n workflows, or a managed service: what each costs, who maintains it, and which fits a SOC with one engineer or none to spare
- Wazuh Vulnerability Report Automation: From Detector Inventory to a Weekly Patch Plan [Reporting] · 2026-10-19 · Turn Wazuh Vulnerability Detector findings into a weekly patch plan: deduplicated CVEs, KEV and EPSS priority, fixes grouped by package, emailed as a PDF
- What Breaks in Your n8n Security Workflows When Wazuh Upgrades [Guide] · 2026-10-12 · A Wazuh upgrade rarely crashes your n8n workflows. They keep running and return less. What changes, a 15-minute check after every upgrade, and how to catch it
- Integrating n8n with Wazuh (Custom Integration) [Guide] · 2026-09-17 · This guide wires the Wazuh manager's integrator daemon to an n8n webhook, so every alert above a chosen severity is POSTed to n8n as JSON for SOAR-style automation. Three files are involved: Naming r…
- I Built a Phishing Email Analyzer in n8n. The AI Does Not Decide the Verdict [Detection] · 2026-09-12 · Every company has the same Slack message
- What Automation Actually Does to a SOC Team [Impact] · 2026-09-01 · About a quarter of security alerts are never investigated, and 60% of teams have had one of those turn into a real incident. Here is what changes when you automate the work, with real numbers.
- n8n Cybersecurity Automation That Does Not Die in Six Months [Insights] · 2026-08-29 · We build security automation for any SIEM, then keep it alive for you
- CTI AI Agent Update: The Before/After of Improving an n8n Workflow for Production [Threat intelligence] · 2026-08-18 · 10 concrete changes, keys out of code, one agent for every IOC type, and the two n8n traps that fail silently.
- Wazuh Rule Tuning Automation Approval-Gated n8n Workflow, 81 Nodes [Rule Tuning] · 2026-08-13 · I let an AI tune my Wazuh rules but only if it asks permission first
- I Automated Threat Hunting on Wazuh with n8n - Here's the Workflow, Node by Node [Threat Hunting] · 2026-07-28 · 31 nodes that run 59 MITRE-mapped hunts every Monday, triage the hits with a local AI, and email one report that opens with the verdict.
- One Wazuh, Many Clients: Why I Built a Multi-Tenant Wazuh Dashboard [Tool] · 2026-07-21 · Wazuh has no clean way to give each client their own view. Here's how I built a multi-tenant Wazuh dashboard with white-label logins without touching the SIEM.
- The Practical Guide to Cybersecurity Automation with Local AI Models [Guide] · 2026-06-30 · After Reading this guide you will understand why local AI matters for security, which models to run, how to run them, how to wire them into n8n, and exactly how to tune them.
- How to Automate a Wazuh Monthly Report (Technical + Management PDFs, Zero Manual Work) [Reporting] · 2026-06-20 · Build an automated Wazuh monthly report in n8n - technical + management PDFs, real charts, MITRE mapping, emailed every month with zero hardcoded data
- AI SOC Agent Pro Edition - Stop Triaging SIEM Alerts Manually [Detection] · 2026-06-17 · I built a 73-node n8n workflow that turns Wazuh alerts into AI-generated incident reports. It runs 100% locally with Ollama
- Deploy Wazuh SIEM at Enterprise Level: Multi-Node Architecture on Ubuntu [Detection] · 2026-06-15 · Build a scalable, enterprise-grade Wazuh deployment with dedicated Indexer, Manager, and Dashboard nodes - the same architecture used to monitor 850+ endpoints in production
- I Spent Days Trying to Break AI Chatbots. Then I Built a Tool That Does It in 5 Minutes. [Pentesting] · 2026-06-05 · Meet the AI Chatbot Security Testing Tool - the fastest way to find out if your assistant is leaking secrets
- I Built an AI SOC Analyst in n8n That Triages Wazuh Alerts For Me - Here’s Every Node, Explained [AI Agent] · 2026-05-31 · How a webhook, a local LLM, and a healthy fear of auto-blocking my own servers turned into a 24/7 tier-1 analyst.
- Automatically Detect New Cyber Threats Before Your Team Reads the News [News] · 2026-05-18 · Stop Scrolling Cybersecurity News: Let This AI Send You Only the Threats That Matter
- Integrating FortiGate Logs with Wazuh [Detection] · 2026-05-05 · Complete Security Monitoring Setup
- AI CTI Agent: Delivers Report & STIX 2.1 Bundles [Automation] · 2026-05-04 · Most CTI workflows are a mess. You get an alert. You copy an IP. You paste it into VirusTotal. You open another tab for AbuseIPDB. You manually check OTX. You try to remember the MITRE technique from…