Auto-Remediate Endpoint Infections with Wazuh, ClamAV, and GPT-4

This n8n workflow automates the process of detecting, analyzing, and remediating endpoint infections, leveraging Wazuh for security monitoring, ClamAV for antivirus scanning, and GPT-4 for intelligent decision-making and response generation. It aims to streamline incident response for endpoint security threats.

What it does

This workflow is designed to be triggered by an external system (e.g., a Wazuh alert) and then intelligently respond to potential endpoint infections.

1. Receives Security Alerts: The workflow starts by listening for incoming data via a Webhook, which is expected to contain information about a potential endpoint infection.
2. Conditional Processing: It uses an "If" node to introduce conditional logic, allowing the workflow to branch based on the content of the incoming alert. This enables different responses for different types of threats or alert severities.
3. No Operation (Placeholder): A "No Operation" node is present, which typically acts as a placeholder or a point where no action is taken, potentially for debugging or future expansion.
4. SSH Command Execution: An SSH node is included, indicating the ability to execute commands on a remote server. This is crucial for actions like initiating ClamAV scans, isolating an endpoint, or retrieving further diagnostic information.
5. AI-Powered Analysis and Remediation:
   • OpenAI Chat Model: An "OpenAI Chat Model" node suggests the use of a Large Language Model (LLM), likely GPT-4, to analyze the threat. This could involve understanding the nature of the infection, suggesting remediation steps, or generating human-readable summaries.
   • AI Agent: An "AI Agent" node (from LangChain) implies a more sophisticated AI interaction, potentially for autonomous decision-making, planning remediation steps, or orchestrating multiple tools based on the LLM's output.
   • Summarization Chain: A "Summarization Chain" node (from LangChain) suggests the capability to summarize complex security logs or incident details into concise reports, likely for human review or further action.
6. Telegram Notification: Finally, a "Telegram" node is used to send notifications, likely to security teams or administrators, informing them about the detected infection, the actions taken, and the results of the remediation.

Prerequisites/Requirements

To effectively use this workflow, you will need:

• n8n Instance: A running n8n instance to host the workflow.
• Webhook Source: An external system (e.g., Wazuh, SIEM) configured to send security alerts to the n8n Webhook URL.
• SSH Access: Credentials and network access for the n8n instance to connect to target endpoints or security servers via SSH.
• OpenAI API Key: An API key for OpenAI (or a compatible LLM provider) to utilize the Chat Model, AI Agent, and Summarization Chain nodes.
• Telegram Bot Token: A Telegram bot token and chat ID(s) for sending notifications.

Setup/Usage

1. Import the Workflow: Download the provided JSON and import it into your n8n instance.
2. Configure Credentials:
   • SSH: Set up your SSH credentials within n8n, pointing to the server(s) where you want to execute commands (e.g., to run ClamAV or perform system actions).
   • OpenAI: Configure your OpenAI API key in n8n's credentials section for the "OpenAI Chat Model" node.
   • Telegram: Set up your Telegram Bot API Token and specify the chat ID where notifications should be sent.
3. Configure Webhook:
   • Activate the "Webhook" trigger node. n8n will provide a unique URL.
   • Configure your external security monitoring system (e.g., Wazuh) to send alerts to this n8n Webhook URL. Ensure the alert payload contains relevant information about the infection (e.g., endpoint name, detected threat, severity).
4. Customize Logic (If Node): Adjust the conditions in the "If" node to match your specific incident response policies. For example, you might want to differentiate between high-severity and low-severity alerts.
5. Customize SSH Commands: Modify the SSH node to execute the specific commands required for your environment, such as:
   • clamscan -r /path/to/scan
   • systemctl stop network-manager (for isolation)
   • rm /path/to/malicious/file
6. Refine AI Prompts: Adjust the prompts and configurations within the "OpenAI Chat Model," "AI Agent," and "Summarization Chain" nodes to ensure the AI provides relevant analysis and generates appropriate responses for your security context.
7. Activate the Workflow: Once configured, activate the workflow in n8n.