Automated Wazuh Alert Response and Virus Scanning Workflow

This n8n workflow streamlines the detection, analysis, and response process for security alerts generated by Wazuh. When a high-severity alert is received via webhook, the workflow first checks the severity and rule ID to identify critical issues. If a high-severity alert matching specific criteria is detected, an OpenAI language model generates a detailed summary as if from a senior SOC analyst. Concurrently, the workflow extracts the infected file path mentioned in the alert log using an AI-powered agent. It then initiates an automated ClamAV virus scan on the identified path via SSH. After the scan completes, a summary report of the activity is compiled, and a notification is sent to stakeholders through Telegram, detailing the alert, scanning process, and results. This automation is useful for rapid incident response, reducing manual effort, and ensuring swift containment of potential threats in cybersecurity operations.