SOC Analyst L1 for Wazuh - Rule-Based, No AI

automation · $49.99

An n8n workflow that turns raw Wazuh alerts into finished incident reports verdict, false-positive call, severity, MITRE technique, and a response playbook without a single line going to an LLM.

No Ollama, no OpenAI key, no GPU, no tokens. It talks to Wazuh over the REST API only (no SSH), enriches any indicator type via VirusTotal + AbuseIPDB, delivers to every channel you want at once, and can auto-block malicious IPs behind a five-way safety gate that ships in dry-run.

The SOC Analyst L1 workflow canvas in n8n, grouped by labelled notes into configuration, input validation, deduplication, Wazuh context, multi-source threat intelligence, rule-based incident analysis, dry-run-safe auto-block, notification and error handling

Who it's for

  • MSSPs and in-house SOCs who want tier-1 triage automated but won't (or can't) run an AI model over customer alert data.

  • Air-gapped / regulated environments where "no data leaves the network for a model" is a hard requirement.

  • Teams that want explainable triage - every verdict traces to a rule you can point at, not a black box.

What makes it different

  • No AI, by design. The report is written by a deterministic engine. It's instant, free to run, identical every time for the same input, and fully auditable. Alert contents never touch a model.

  • Every IOC type, not just IPs. File hashes, URLs, domains and IPs are all extracted and sent to the matching VirusTotal endpoint. A malware FIM alert gets a file-reputation lookup; a web alert gets a URL lookup.

  • Safe out of the box. Auto-blocking is gated by dry-run + master switch + IP/CIDR whitelist + VirusTotal threshold + minimum rule level. All five must agree. Dry-run ships on.

  • Delivers everywhere at once. Discord, Slack, Telegram and Email (SMTP or Gmail) in parallel - a dead channel can't stop the others. Email goes out as a designed HTML report with three swappable templates.

  • Production hardened. Input sanitization against command injection, stateful deduplication so a brute-force burst is one report not two hundred, and a self-reporting error handler.

Requirements

  • n8n v1+

  • Wazuh Manager & Indexer (REST API)

  • Free VirusTotal & AbuseIPDB API keys

  • At least one notification channel

7-day guarantee

If it doesn't work as described, or it isn't what you needed, contact us within 7 days of purchase and we'll refund you in full. If you'd rather have it working, say so and we'll help you get it running. Your call. Full terms.

Related

Want an LLM to write the narrative instead of rules? See AI SOC Analyst L1 For Wazuh

Need live log pull over SSH and ufw blocking? See AI SOC Analyst L1 (multi-VM SSH edition).

← Browse all products