Automated Threat Hunting for Wazuh SIEM (n8n AI agent) + Guide + Bonus

Automated Threat Hunting for Wazuh Threat hunting keeps losing to the alert queue. Not because it's difficult, but because it requires a senior analyst and a free afternoon and that afternoon never comes. This n8n workflow automates the process. Every week it searches your Wazuh environment for signs of credential theft, lateral movement, web shells, ransomware staging, persistence, and dozens of other attacker techniques. Findings are automatically enriched with VirusTotal, AlienVault OTX, and AbuseIPDB, analyzed by a local AI model (optional), and delivered as a single analyst-ready report. Unlike static dashboards or manual hunting, this workflow continuously executes 59 MITRE ATT&CK-mapped threat hunting hypotheses , so your team spends minutes reviewing results instead of hours writing and running queries. At a glance ✅ 59 MITRE ATT&CK-mapped threat hunts ✅ Automated weekly execution ✅ Rotating hunt schedule or full library execution ✅ VirusTotal, AlienVault OTX & AbuseIPDB enrichment ✅ Optional local AI-powered triage (Ollama) ✅ Analyst-ready HTML email reports ✅ Fully customizable hunt library ✅ Runs entirely on your infrastructure ✅ Around 15-minute setup How i…