Auto Remediate Endpoint Infections with Wazuh, ClamAV & GPT-4

This workflow reduces human delays between malware detection and remediation in MSSP/SOC environments by automating antivirus scanning immediately after high-severity Wazuh endpoint infection alerts (e.g., rule 52502). It listens for alerts via webhook, employs GPT-4 for AI-powered summaries to accelerate triage, extracts infected file paths with AI and regex, and initiates targeted ClamAV or Defender scans directly on Linux/Windows endpoints using SSH with least-privilege credentials.

Key benefits include eliminating manual lag—scans start within one minute—standardizing response playbooks for reliable remediation, reducing threat dwell time, and providing full visibility via logs and real-time notifications through Telegram, Slack, or email. It runs locally without needing elevated Wazuh manager access, ensuring consistent, auditable actions across endpoints.

Ideal for security teams managing endpoints at scale. Configure Wazuh to forward alerts, import the workflow into n8n, set up OpenAI API, SSH credentials, and notification channels, then activate for automated threat response. Monitor for scans and remediation updates to minimize risk exposure.