Automate Wazuh alert triage and reporting with GPT-4o-mini and Telegram

🚨Are alert storms overwhelming your Security Operations workflows?

This n8n workflow supercharges your SOC by fully automating triage, analysis, and notification for Wazuh alerts—blending event-driven automation, OpenAI-powered contextual analysis, and real-time collaboration for incident response.

🔑 Key Features:

✅ Automated Triage: Instantly filters Wazuh alerts by severity to focus analyst effort on the signals that matter.

🤖 AI-Driven Investigation Reports: Uses OpenAI's GPT-4o-mini to auto-generate context-rich incident reports, including: - MITRE Tactic & Technique mapping - Impacted scope (IP addresses, hostnames) - External artifact reputation checks - Actionable security recommendations - Fully customizable prompt format aligned with your SOC playbooks

📡 Multi-Channel Notification Delivers clean, actionable reports directly to your SOC team via Telegram. Easily extendable to Slack, Outlook, Gmail, Discord, or any other preferred channel.

🔇 Noise Reduction Eliminates alert fatigue using smart filters and custom AI prompts that suppress false positives and highlight real threats.

🔧 Fully Customizable Tweak severity thresholds, update prompt logic, or integrate additional data sources and channels — all with minimal effort