Send Wazuh security alerts as Gemini-enriched email reports and notifications
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 30 nodes and runs manually, when you click “Execute workflow” (plus 3 other triggers). Along the way it connects Google Gemini Chat Model.
How it runs
Trigger: Manually, when you click “Execute workflow” (plus 3 other triggers).
- Use manual reporting mode (Edit Fields (Set)): sets 1 field: runMode
- Use immediate notification mode (Edit Fields (Set)): sets 1 field: runMode
- Use weekly reporting mode (Edit Fields (Set)): sets 1 field: runMode
- Use monthly reporting mode (Edit Fields (Set)): sets 1 field: runMode
- Configure alert intelligence workflow (Edit Fields (Set)): sets 14 fields: organizationName, organizationKey, wazuhIndexerUrl…
- Load enabled delivery profiles (Data table): get
- Prepare bounded Wazuh alert query (Code): runs custom JavaScript code
- Query Wazuh alert evidence (HTTP Request): calls an HTTP API (POST)
- Build deterministic security context (Code): runs custom JavaScript code
- Continue only when delivery is needed (If): checks a condition and branches into true / false
…plus 13 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (12)
- Manual Trigger
n8n-nodes-base.manualTrigger - Edit Fields (Set)
n8n-nodes-base.set - Schedule Trigger
n8n-nodes-base.scheduleTrigger - Data table
n8n-nodes-base.dataTable - Code
n8n-nodes-base.code - HTTP Request
n8n-nodes-base.httpRequest - If
n8n-nodes-base.if - Convert to File
n8n-nodes-base.convertToFile - Send Email
n8n-nodes-base.emailSend - Basic LLM Chain
@n8n/n8n-nodes-langchain.chainLlm - Google Gemini Chat Model
@n8n/n8n-nodes-langchain.lmChatGoogleGemini - Structured Output Parser
@n8n/n8n-nodes-langchain.outputParserStructured
From the author
Quick Overview This workflow queries Wazuh Indexer on a schedule or manually, summarizes alert activity, uses Google Gemini to generate structured security insights, and sends role-based HTML email reports or immediate alert notifications via SMTP, optionally…