Automate security alert triage with NixGuard AI and route to Slack or Jira

by Jonathan | NEX ✓ · 1,814 views · created 2025-07-12 · SecOps, AI Summarization

What this workflow does

This workflow has 17 nodes and runs on a schedule (every hour). Along the way it connects Slack.

How it runs

Trigger: On a schedule (every hour).

1. Set API Key & Initial Prompt (Edit Fields (Set)): sets or maps fields
2. Execute: Get Daily Events as JSON (Get Real-Time Security Insights with NixGuard RAG and Wazuh Integration) (Execute Sub-workflow): calls another n8n workflow
3. Parse Alert Array (Code): runs custom JavaScript code
4. If: checks a condition and branches into true / false
5. Edit Fields (Edit Fields (Set)): sets 1 field: output
6. Parse & Split Alerts (Code): runs custom JavaScript code
7. Filter for Important Alerts (Level > 7) (If): checks a condition and branches into true / false
8. Aggregate: combines items into one
9. Set Prompt for Summary (Edit Fields (Set)): sets or maps fields
10. Execute: Generate Slack Message (Get Real-Time Security Insights with NixGuard RAG and Wazuh Integration) (Execute Sub-workflow): calls another n8n workflow

…plus 6 more steps. See the full node list below.

Services it uses

Slack

Before you upgrade to n8n 3.0

Nodes used (8)

• Schedule Triggern8n-nodes-base.scheduleTrigger
• Coden8n-nodes-base.code
• Edit Fields (Set)n8n-nodes-base.set
• Execute Sub-workflown8n-nodes-base.executeWorkflow
• Ifn8n-nodes-base.if
• Aggregaten8n-nodes-base.aggregate
• Slackn8n-nodes-base.slack
• Switchn8n-nodes-base.switch

From the author

Are you drowning in a sea of security notifications? Do your analysts spend more time sifting through low-level logs than investigating real threats? This workflow transforms n8n into an autonomous SOC (Security Operations Center) Analyst, tackling alert…

View the original on n8n.io → Check your own copy