Wazuh Alert Triage & AI Reporting with GPT-4o-mini & Telegram

This n8n workflow transforms Wazuh alert management by automating triage, AI-powered analysis, and multi-channel reporting. It starts with a webhook capturing real-time Wazuh alerts, filters them by severity to prioritize high-impact events, and leverages OpenAI's GPT-4o-mini via LangChain for in-depth investigation. The AI generates comprehensive reports including incident overviews, MITRE ATT&CK mappings, impacted assets, threat classifications, risk assessments, and actionable recommendations aligned with SOC playbooks.

Key benefits include drastic noise reduction through smart filtering and AI-driven false positive suppression, enabling SOC teams to focus on genuine threats. It eliminates manual log reviews, provides instant collaboration via Telegram (extendable to Slack, email, etc.), and supports customization for severity thresholds, prompts, and integrations. This results in faster incident response, reduced analyst burnout, and enhanced security posture.

Ideal use cases: SOC operations handling high-volume alerts, MSSPs streamlining client monitoring, or DevSecOps teams integrating security into CI/CD. Perfect for environments using Wazuh for endpoint detection, compliance monitoring, or threat hunting, saving hours daily on routine triage.