Automate Wazuh alert triage and reporting with GPT-4o-mini and Telegram
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 6 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Telegram and OpenAI Chat Model.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- If: checks a condition and branches into true / false
- Investigation Summarization (Summarization Chain): summarizes text with AI, with model: Customized AI Model
- SOC Team (Telegram): uses Telegram
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (6)
- If
n8n-nodes-base.if - Webhook
n8n-nodes-base.webhook - No Operation, do nothing
n8n-nodes-base.noOp - Summarization Chain
@n8n/n8n-nodes-langchain.chainSummarization - Telegram
n8n-nodes-base.telegram - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi
From the author
🚨Are alert storms overwhelming your Security Operations workflows? This n8n workflow supercharges your SOC by fully automating triage, analysis, and notification for Wazuh alerts—blending event-driven automation, OpenAI-powered contextual analysis, and…