Auto Remediate Endpoint Infections with Wazuh, Clamav, and Gpt-4

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "nodes": [
    {
      "id": "fb1f79ac-2b5a-4bac-8f49-9d4938ea8c9b",
      "name": "Wazuh Alert",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -640,
        -112
      ],
      "parameters": {
        "path": "de0c6d77-ae71-4d78-9f10-502eaa851ce8",
        "options": {
          "rawBody": true
        },
        "httpMethod": "POST"
      },
      "typeVersion": 2
    },
    {
      "id": "961ed6cb-a6b7-401f-a2b5-aaadf91ab4f1",
      "name": "No Operation, do nothing",
      "type": "n8n-nodes-base.noOp",
      "position": [
        -112,
        32
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "6ed0c622-e956-46da-87bb-82d96548f108",
      "name": "OpenAI Chat Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        -96,
        -144
      ],
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "84cfeaa8-db3b-48be-a89d-fd2f9a3d66ec",
      "name": "OpenAI Chat Model1",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        304,
        -48
      ],
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "b8e61b73-87fd-4511-9514-03135d34c348",
      "name": "Check High Severity",
      "type": "n8n-nodes-base.if",
      "position": [
        -416,
        -112
      ],
      "parameters": {
        "options": {
          "ignoreCase": true
        },
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": false,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "0c8dba85-ab11-4ef9-9049-d3ad934976ef",
              "operator": {
                "name": "filter.operator.equals",
                "type": "string",
                "operation": "equals"
              },
              "leftValue": "={{ $json.body.severity }}",
              "rightValue": "3 high"
            },
            {
              "id": "2a4587f8-ccae-435c-8c67-1606811538a2",
              "operator": {
                "name": "filter.operator.equals",
                "type": "string",
                "operation": "equals"
              },
              "leftValue": "={{ $json.body.rule_id }}",
              "rightValue": "=52502"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "cad813f2-fb68-4e31-a85c-5732f11f4f96",
      "name": "Summarize Alert",
      "type": "@n8n/n8n-nodes-langchain.chainSummarization",
      "position": [
        -192,
        -368
      ],
      "parameters": {
        "options": {
          "summarizationMethodAndPrompts": {
            "values": {
              "prompt": "Write a detailed concise summary of the following as a Senior soc analyst:\n\n\n\"{text}\"\n\n\nCONCISE SUMMARY:",
              "combineMapPrompt": "=You are the Wazuh AI Assistant created by Mariskarthick. \n\nYou should act as a Senior experienced SOC Analyst\n\nYour main purpose is to run the ClamAV if wazuh siem detected a ClamAV: Virus detected alert. you have full access to the all the machines via ssh and initate a CLAM AV scan using this command  sudo clamscan -r \"mention the path where the virus is detected\"  --bell -i\n\nfor example:  sudo clamscan -r /test --bell -i\n\nonce the scanning is done, consolidate the output of the scan and initiate a msg to stateholder via shadowArk telegram trigger\n\nyou can refer the below details:\n Wazuh detected alert Name: {{ $json.body.title }}\nFull log: {{ $json.body.text }}\n"
            }
          }
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "3c6645a6-3d16-48ec-8f35-a850244c3536",
      "name": "Extract Path",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        208,
        -256
      ],
      "parameters": {
        "text": "={{ $json.output.text }}\n\nYou are the wazuh AI Assistant. your primary task is to understand the abive mentioend text and extract the path where the virus got detected on the below format:\n\nExamle: \n\ntext:\nA high-severity WAZUH alert was triggered on July 30, 2025, indicating ClamAV detected the EICAR test virus (EICAR.TEST.3.UNOFFICIAL) in the file `/test/eicar.com` on the host `shadowark`. The detection was logged by the ClamAV daemon (clamd) and confirmed repeatedly at 13:44:27, involving components such as freshclam and journald. The alert originated from IP `122.178.166.190` accessing `3aad845638746618f1a5187d93674f5f.n8n.selfmade.codes` via HTTPS.\n\noutput required:\n/test/eicar.com",
        "options": {},
        "promptType": "define"
      },
      "typeVersion": 2.1
    },
    {
      "id": "f44a9bc0-46d4-45c3-aaaa-3bf2eb567578",
      "name": "Run AV Scan",
      "type": "n8n-nodes-base.ssh",
      "position": [
        608,
        -256
      ],
      "parameters": {
        "command": "=clamscan -r {{ $json.output }} --bell -i"
      },
      "credentials": {
        "sshPassword": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1
    },
    {
      "id": "8858c573-ad0b-4f14-8a19-993a93f6d8ca",
      "name": "Notify Stateholders via Telegram",
      "type": "n8n-nodes-base.telegram",
      "position": [
        816,
        -272
      ],
      "parameters": {
        "text": "=Notification: \n\n{{ $('Summarize Alert').item.json.output.text }}\n\n\nFollowed by the above activity, the scanning has been initiated and completed successfully. please find the below details.\n\n{{ $json.stdout }}\n\nThank you!\nMariskarthick M",
        "chatId": "123456789",
        "additionalFields": {}
      },
      "credentials": {
        "telegramApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.2
    }
  ],
  "connections": {
    "Run AV Scan": {
      "main": [
        [
          {
            "node": "Notify Stateholders via Telegram",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wazuh Alert": {
      "main": [
        [
          {
            "node": "Check High Severity",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Path": {
      "main": [
        [
          {
            "node": "Run AV Scan",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Summarize Alert": {
      "main": [
        [
          {
            "node": "Extract Path",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Chat Model": {
      "ai_languageModel": [
        [
          {
            "node": "Summarize Alert",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Chat Model1": {
      "ai_languageModel": [
        [
          {
            "node": "Extract Path",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Check High Severity": {
      "main": [
        [
          {
            "node": "Summarize Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No Operation, do nothing",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• openAiApi
• sshPassword
• telegramApi

About this workflow

Reduce human delays between malware detection and remediation in MSSP/SOC environments. This workflow automates full endpoint antivirus scanning immediately after high-severity endpoint infection wazuh alerts, closing the gap between alerting and action.

Source: https://n8n.io/workflows/7022/ — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.