Automated Malicious File Detection with Wazuh and n8n

This n8n workflow is designed to enhance your security posture by automating the detection and notification of malicious file activities. When Wazuh identifies a suspicious file, this workflow springs into action. It captures the alert, extracts crucial Indicators of Compromise (IOCs), and then queries a threat intelligence service (like VirusTotal, inferred from node 'Generate File Summary') to gather detailed analysis and reputation data. If the file is flagged as suspicious or malicious, a comprehensive summary is generated, and an incident is automatically created in ServiceNow. Finally, a detailed email alert is sent to the security team, providing immediate visibility into potential threats.