Not yet built — scope defined, no working pipeline
Scope
A planned automation layer that sits on top of the Wazuh lab: an alert webhook triggering an n8n workflow, a Python step to enrich indicators against VirusTotal, and case creation via TheHive’s API.
Nothing here is running yet. It depends on the Wazuh deployment reaching a state where it produces alerts worth automating, which is the current priority. I’d rather ship one working webhook-to-case path with a screenshot than describe a pipeline I haven’t built.
Planned Pipeline
Wazuh Alert → n8n Webhook → Python Enrichment → TheHive Case
Diagram reflects the planned design, not a running system.
Tool Stack (Planned)
- n8n — workflow orchestration
- TheHive API — case creation, depends on the Wazuh page’s TheHive configuration step
- Wazuh — alert source
- Python — IOC enrichment logic
- VirusTotal API — hash and IP reputation lookups
Build Order
- Finish TheHive configuration on the Wazuh lab (blocking dependency)
- Wire a single Wazuh webhook to a basic n8n workflow
- Add VirusTotal enrichment for one indicator type
- Automate case creation in TheHive from the enriched result
- Document with a real screenshot of one alert moving through the full path