Auto remediate endpoint infections with Wazuh, ClamAV, and GPT-4
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 9 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects OpenAI Chat Model and Telegram.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Check High Severity (If): checks a condition and branches into true / false
- Summarize Alert (Summarization Chain): summarizes text with AI, with model: OpenAI Chat Model
- Extract Path (AI Agent): runs an AI agent, with model: OpenAI Chat Model
- Run AV Scan (SSH): uses SSH
- Notify Stateholders via Telegram (Telegram): uses Telegram
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (8)
- Webhook
n8n-nodes-base.webhook - No Operation, do nothing
n8n-nodes-base.noOp - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - If
n8n-nodes-base.if - Summarization Chain
@n8n/n8n-nodes-langchain.chainSummarization - AI Agent
@n8n/n8n-nodes-langchain.agent - SSH
n8n-nodes-base.ssh - Telegram
n8n-nodes-base.telegram
From the author
Reduce human delays between malware detection and remediation in MSSP/SOC environments. This workflow automates full endpoint antivirus scanning immediately after high-severity endpoint infection wazuh alerts, closing the gap between alerting and action. Why…