What you're getting

A complete, working AI SOC automation pipeline — the exact one I built, documented and packaged so you can stand it up yourself, no guesswork.

This isn't a theory doc. It's the real n8n workflow, the real integration script, and the real setup steps I used to catch live attacks (tested against Atomic Red Team / MITRE ATT&CK techniques) and route them straight into Slack and Jira with an AI-generated verdict.

Included in the kit

- n8n workflow file (.json) — import-ready, every node pre-built: fingerprinting/de-dup, threat intel enrichment (AbuseIPDB + VirusTotal), MITRE-based scoring, and the AI triage agent

- Python integration script that connects Wazuh Manager to n8n via webhook

- Step-by-step setup guide (PDF) — Docker setup, Wazuh Manager + Agent install, credential configuration, and node-by-node walkthrough

- The exact AI prompt/logic used for the Tier-1 analyst verdict (true positive / false positive / needs review)

- A testing checklist using Atomic Red Team so you can verify your build actually catches real attack techniques

Who this is for

Security folks, students, or builders who want a working AI-augmented SOC pipeline without spending weeks reverse-engineering the architecture from scratch. Basic familiarity with Docker and Wazuh helps but isn't required — the guide starts from zero.

What you'll be able to do after this

Deploy Wazuh, wire it into n8n, enrich and score alerts automatically, get AI-generated verdicts on real security events, and have true positives land in Slack/Jira automatically — the same pipeline demonstrated in the video below.