Real-Time Security Alerts Automation and Orchestration using Wazuh and n8n

In today’s world, the frequency of cyber attacks is increasing day by day, and many open-source tools are used for threat detection and security in every organization. Many SIEM software, such as Wazuh, are used to detect threats and provide details about the attack, while n8n can serves like an automated tool. This research proposed an automated notification workflow design for incident response. It shows that, instead of manual monitoring, this integration can delivers real-time notifications to administrators via Gmail. This framework shows how to integrate Wazuh with n8n to produce real-time Gmail alerts. In this, the OAuth 2.0 protocol is used for a secure connection. In this, the original password cannot be used; the system was implemented with API credentials like Client ID and Client Secret tokens instead of the original password to maintain a secure connection. When Wazuh sends logs to n8n via webhook, they provide data in JSON format. Additionally, it works like a rule based system in the form of automation, in which if the attack reaches level 10+ or high severity, the system sends a Gmail alert; otherwise, Wazuh continues to detect every threat.