Building an Event-Driven AI SOC Analyst with Wazuh & n8n

Replace manual triage fatigue with autonomous threat remediation. Ingest real-time host logs via Wazuh SIEM, extract IOC hashes using custom decoders, enrich indicators through a local FastMCP VirusTotal server, and trigger host containment via n8n agentic workflows.

System Architecture

Traditional Security Operations Centers (SOCs) drown in false positives. This event-driven architecture transforms passive monitoring into active threat response by bridging open-source SIEM detection with agentic tool execution.

1. Ingestion (Wazuh SIEM)

Monitors endpoints, logs syslogs, parses custom XML decoders, and outputs structured alert events.

2. Pipeline Orchestration (n8n)

Receives webhooks, routes telemetry payloads, invokes MCP intelligence, and evaluates response logic.

3. Threat Intelligence (FastMCP)

Exposes standard Model Context Protocol tools to query VirusTotal API v3 for file reputation analysis.

4. Autonomous Containment

Triggers active response scripts on the compromised agent to isolate network interfaces or kill malicious PIDs.

Step 1: Configure Custom Wazuh Decoders & Rules

Add custom decoders to /var/ossec/etc/decoders/local_decoder.xml to parse file hashes from raw syslog telemetry:

<decoder name="custom_syslog_decoder">
  <prematch>^\d{4}-\d{2}-\d{2}T</prematch>
</decoder>

<decoder name="custom_syslog_fields">
  <parent>custom_syslog_decoder</parent>
  <regex>(\S+) (\S+): (\S+) hash=(\w+)</regex>
  <order>hostname, program_name, action, file_hash</order>
</decoder>

Next, create a high-severity alert rule in /var/ossec/etc/rules/local_rules.xml linked to MITRE ATT&CK T1059:

<group name="syslog,security_event,">
  <rule id="100002" level="10">
    <decoded_as>custom_syslog_decoder</decoded_as>
    <field name="file_hash">\w+</field>
    <description>Suspicious Execution - Hash Extracted: $(file_hash)</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Step 2: Deploy FastMCP VirusTotal Server

Build a lightweight TypeScript FastMCP server to provide structured threat intelligence tools to your agent:

import { FastMCP } from "fastmcp";
import axios from "axios";

const server = new FastMCP({
  name: "virustotal-enricher",
  version: "1.0.0",
});

server.addTool({
  name: "check_file_hash",
  description: "Queries VirusTotal API v3 for file hash reputation",
  parameters: {
    type: "object",
    properties: {
      hash: { type: "string", description: "SHA256, SHA1, or MD5 hash" },
    },
    required: ["hash"],
  },
  execute: async ({ hash }) => {
    const apiKey = process.env.VIRUSTOTAL_API_KEY;
    const response = await axios.get(
      `https://www.virustotal.com/api/v3/files/${hash}`,
      { headers: { "x-apikey": apiKey } }
    );
    const stats = response.data.data.attributes.last_analysis_stats;
    return JSON.stringify({
      malicious: stats.malicious,
      suspicious: stats.suspicious,
      harmless: stats.harmless,
      verdict: stats.malicious > 3 ? "ISOLATE_HOST" : "CLEAN",
    });
  },
});

server.start({ transport: "stdio" });

Step 3: Connect n8n Webhook & Containment Pipeline

Configure Wazuh integrator to forward Rule 100002 events directly to your n8n Webhook endpoint:

{
  "event": "wazuh_alert",
  "rule_id": 100002,
  "agent_id": "004",
  "agent_name": "sec-prod-node-01",
  "file_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "severity": 10
}

If the VirusTotal verdict returns ISOLATE_HOST, n8n invokes Wazuh REST API (PUT /active-response) to trigger host firewall isolation on agent_id: 004 within milliseconds.

Open Source Lab Repository

Access full decoder XML files, n8n JSON workflow templates, and test scripts on GitHub.

View Repo

Ready to Deploy Autonomous AI SOC Operations?

At Ulakto, we build custom SOC automation pipelines, agentic threat detection workflows, and custom MCP integrations tailored to enterprise infrastructure.

Book System Architecture Consultation