AutomationFlows โ€บ Slack & Telegram โ€บ Automated Wazuh Rule Deployment Pipeline with Github, XML Validation &โ€ฆ

Automated Wazuh Rule Deployment Pipeline with Github, XML Validation &โ€ฆ

Original n8n title: Automated Wazuh Rule Deployment Pipeline with Github, XML Validation & Telegram Alerts

Bymariskarthick @mariskarthickโœ“ on n8n.io

๐Ÿš€ Say Goodbye to Manual Rule Deployments in Wazuh!

Event triggerโ˜…โ˜…โ˜…โ˜…โ˜† complexity14 nodesGithub TriggerHTTP RequestSshTelegram
Slack & Telegram Trigger: Event Nodes: 14 Complexity: โ˜…โ˜…โ˜…โ˜…โ˜† Added:

This workflow corresponds to n8n.io template #7226 โ€” we link there as the canonical source.

This workflow follows the HTTP Request โ†’ Telegram recipe pattern โ€” see all workflows that pair these two integrations.

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide โ†’

Download .json
{
  "id": "ycZ4TnsQsex77CYk",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "Wazuh RuleOpsX \u2013 Auto-Validate, Deploy & Elevate Detection",
  "tags": [],
  "nodes": [
    {
      "id": "4dc3a66e-3caa-4f98-8bd0-39ac49a2c6cd",
      "name": "Github Trigger",
      "type": "n8n-nodes-base.githubTrigger",
      "position": [
        -848,
        -48
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "33ab571c-aed9-4713-8b3f-6b958ac24604",
      "name": "Extract Changed Files",
      "type": "n8n-nodes-base.code",
      "position": [
        -400,
        -144
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "1059c81d-c8df-4823-b8f3-b5fb6196686a",
      "name": "Download Rule",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -176,
        -144
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "96ab9e75-66b0-4bd5-822f-489a326ec127",
      "name": "Upload a file",
      "type": "n8n-nodes-base.ssh",
      "position": [
        48,
        -144
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "46fd91e3-8b95-4cff-b93a-132b4a730295",
      "name": "\u274c Failure Message",
      "type": "n8n-nodes-base.telegram",
      "position": [
        1392,
        -144
      ],
      "parameters": {},
      "typeVersion": 1.2
    },
    {
      "id": "aacc31f6-4b99-48f0-96bf-8a22243f9a06",
      "name": "\u2705 Success Message",
      "type": "n8n-nodes-base.telegram",
      "position": [
        1392,
        -336
      ],
      "parameters": {},
      "typeVersion": 1.2
    },
    {
      "id": "0c078ecb-0155-4682-bb26-72ec53dcc2c2",
      "name": "Restart Wazuh_manager",
      "type": "n8n-nodes-base.ssh",
      "position": [
        944,
        -240
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "dc1a2dd9-042b-4a48-b888-a4c191d135b9",
      "name": "Deploying the Rules",
      "type": "n8n-nodes-base.ssh",
      "position": [
        720,
        -240
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "6dc9b783-45ab-4dfd-a09a-bf1d6a7db54a",
      "name": "Rule Validation",
      "type": "n8n-nodes-base.ssh",
      "position": [
        272,
        -144
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "405115db-ece3-4bfd-bc69-4f942322322a130",
      "name": "Rules deployment failed",
      "type": "n8n-nodes-base.telegram",
      "position": [
        720,
        -48
      ],
      "parameters": {},
      "typeVersion": 1.2
    },
    {
      "id": "d64b8fa3-ffa7-4437-a8af-4e8476cf01c8",
      "name": "No Operation, do nothing",
      "type": "n8n-nodes-base.noOp",
      "position": [
        -400,
        48
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "f2cb2437-2703-499f-aebf-bbeaccc3b290",
      "name": "Valid Commit for Deployment",
      "type": "n8n-nodes-base.if",
      "position": [
        -624,
        -48
      ],
      "parameters": {},
      "typeVersion": 2.2
    },
    {
      "id": "f9ec8d14-25a7-483f-b879-781e70b89d80",
      "name": "Rule Validation check",
      "type": "n8n-nodes-base.if",
      "position": [
        496,
        -144
      ],
      "parameters": {},
      "typeVersion": 2.2
    },
    {
      "id": "6db2dc61-776a-4fb8-9c78-2c4b54e9b1ea",
      "name": "Final Confirmation check",
      "type": "n8n-nodes-base.if",
      "position": [
        1168,
        -240
      ],
      "parameters": {},
      "typeVersion": 2.2
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "348e2496-9d89-4395-9e3c-e6f3e640ffd6",
  "connections": {
    "Download Rule": {
      "main": [
        [
          {
            "node": "Upload a file",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Upload a file": {
      "main": [
        [
          {
            "node": "Rule Validation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Github Trigger": {
      "main": [
        [
          {
            "node": "Valid Commit for Deployment",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Rule Validation": {
      "main": [
        [
          {
            "node": "Rule Validation check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Deploying the Rules": {
      "main": [
        [
          {
            "node": "Restart Wazuh_manager",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Changed Files": {
      "main": [
        [
          {
            "node": "Download Rule",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Restart Wazuh_manager": {
      "main": [
        [
          {
            "node": "Final Confirmation check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Rule Validation check": {
      "main": [
        [
          {
            "node": "Deploying the Rules",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Rules deployment failed",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Final Confirmation check": {
      "main": [
        [
          {
            "node": "\u2705 Success Message",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "\u274c Failure Message",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Valid Commit for Deployment": {
      "main": [
        [
          {
            "node": "Extract Changed Files",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No Operation, do nothing",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Pro

For the full experience including quality scoring and batch install features for each workflow upgrade to Pro

About this workflow

๐Ÿš€ Say Goodbye to Manual Rule Deployments in Wazuh!

Source: https://n8n.io/workflows/7226/ โ€” original creator credit. Request a take-down โ†’

More Slack & Telegram workflows โ†’ ยท Browse all categories โ†’

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.

Slack & Telegram

n8n update. Uses ssh, manualTrigger, scheduleTrigger, stickyNote. Event-driven trigger; 27 nodes.

Ssh, HTTP Request, Telegram
Slack & Telegram

This workflow is for DevOps engineers, system administrators, and Docker users who want to automate the process of checking for updates, verifying them, and applying updates to their Docker-based depl

Ssh, HTTP Request, Telegram
Slack & Telegram

TextMain. Uses telegramTrigger, stopAndError, telegram, httpRequest. Event-driven trigger; 56 nodes.

Telegram Trigger, Stop And Error, Telegram +2
Slack & Telegram

Pede Ai. Uses httpRequest, telegram, postgres, telegramTrigger. Event-driven trigger; 53 nodes.

HTTP Request, Telegram, Postgres +1
Slack & Telegram

๐Ÿ“„ Documentation: Notion Guide

Telegram Trigger, @Blotato/N8N Nodes Blotato, Telegram +1