I Automated My Entire SOC With AI — Wazuh + n8n + Ollama (73 Nodes)

🔒 I built this n8n workflow that automatically triages Wazuh alerts using AI. VirusTotal + AbuseIPDB enrichment, auto-blocking, vulnerability assessment, and full incident reports — all running locally with Ollama. No cloud. No subscriptions. In this video, I walk through every part of the workflow: how it works, my 3-VM Wazuh infrastructure, the AI analysis pipeline, Windows/macOS support, and a live demo showing the entire pipeline execute in real time. 👉 Get the workflow + setup guide: https://neetrox.gumroad.com/l/ai-soc-... 👉 For Paypal payment from here: https://payhip.com/Neetrox ━━━━━━━━━━━━━━━━━━━━━━━ ⏱️ TIMESTAMPS 0:00 — Intro: Why I automated my SOC 0:30 — My Infrastructure: 3 Wazuh VMs + n8n + IRIS 1:45 — Webhook Entry Point & Configuration Node 2:15 — Input Sanitization (Anti Command Injection) 2:45 — Alert Deduplication (50 Alerts → 1) 3:15 — OS Detection & Routing (Linux / Windows / macOS) 3:45 — Threat Intel: VirusTotal + AbuseIPDB (Combined Score) 4:30 — Log Pulling & AI Log Analysis 5:00 — AI Incident Report Generation 5:30 — Vulnerability Assessment Pipeline (Wazuh CVE Detection) 6:00 — Auto-Block With IP Whitelist Safeguards 6:30 — Error Handling 6:45 — Windows & macOS Paths Explained 7:45 — Live Demo: Real Alert → Full Pipeline Execution 9:15 — Results & Closing ━━━━━━━━━━━━━━━━━━━━━━━ 📦 WHAT THE WORKFLOW INCLUDES ✅ 73 nodes — fully wired, tested, documented ✅ Multi-OS — Linux, Windows (PowerShell), macOS ✅ Dual threat intel — VirusTotal + AbuseIPDB with combined 0-100 score ✅ AI incident reports — powered by Ollama (local, private) ✅ Vulnerability assessment — Wazuh CVE detection with AI reports ✅ Auto-block — UFW deny via SSH with CIDR whitelist ✅ Deduplication — fingerprint-based cooldown ✅ Input sanitization — prevents command injection ✅ Multi-channel — Discord, Slack, Telegram, Email ✅ TheHive integration — case creation with MITRE tags ✅ Google Sheets audit log — compliance trail ✅ Error handling — catches failures, alerts you ━━━━━━━━━━━━━━━━━━━━━━━ #WazuhSIEM #n8nAutomation #Ollama #SOCAutomation #Cybersecurity #ThreatIntelligence #IncidentResponse #AISecurityAnalyst #SIEM #OpenSourceSecurity