This workflow streamlines the process of managing and investigating low-severity security alerts from Wazuh. When a POST request is received via the webhook node, the workflow first checks if the alert’s severity level equals ‘1 low’. If it does, the workflow proceeds to generate a detailed investigation report using an AI-powered summarization node, which analyzes the alert details and provides structured insights such as the alert description, techniques used, impacted scope, external artifacts, and security recommendations. The generated report is then cleaned up to remove unnecessary formatting and forwarded through Telegram to the SOC team for review. This automation helps security teams quickly assess low-severity alerts, ensuring timely responses while reducing manual effort.