Active build in progress. Documentation being written alongside development.
Overview
Building an end-to-end automated alert triage and incident response pipeline that significantly reduces manual SOC analyst workload. When Wazuh fires an alert, a webhook triggers an n8n workflow that enriches the IOC data via Python scripts, then automatically creates a structured case in TheHive with full context — replicating a SOAR-style automation workflow in a self-hosted environment.
The goal is a zero-touch pipeline from alert detection to case creation, with enrichment covering IP reputation, file hash lookups, and threat intelligence context — demonstrating real-world SOC automation skills without requiring enterprise tooling licenses.
Automation Pipeline
Tool Stack
Write-Up In Progress
Documentation is being written alongside active development. The completed write-up will include:
Coming soon
- Full n8n workflow diagram — webhook trigger to case creation
- Python enrichment script breakdown — IOC lookup and threat intel
- TheHive case template configuration and field mapping
- Wazuh webhook integration setup and alert filtering logic
- VirusTotal API integration for automated hash and IP reputation checks
- Before/after comparison — manual triage time vs. automated pipeline
- Demo video walkthrough of a live alert moving through the pipeline