Wazuh Alerts to Gemini Email Reports in n8n Workflow Automation

Turn Wazuh security alerts into Gemini-powered email reports—automatically in n8n

This n8n workflow pulls scheduled or urgent alerts from Wazuh Indexer, summarizes them, asks Google Gemini for structured security insights, and sends role-based HTML email reports (with optional PDF delivery via Gotenberg) or immediate per-event notifications via SMTP.

What this workflow does

• Runs on schedule or manually (including an “urgent” mode every 5 minutes), using a run mode to build the correct time-bounded Wazuh Indexer query.
• Loads enabled delivery profiles from an n8n Data Table and determines who should receive which reports.
• Queries Wazuh Indexer for alerts and aggregations, then derives severity counts, coverage signals, top rules/agents, MITRE context, and an evidence sample.
• Stops early when there’s nothing to send (e.g., no eligible report run or no high-severity events in immediate mode).
• Uses Google Gemini to transform the minimized alert summary into a validated structured JSON response, which drives the final report content.
• Sends role-based HTML reports via email; optionally converts HTML to PDF using Gotenberg and attaches it.
• Logs deliveries to an n8n Data Table for traceability.
• Immediate alerts: suppresses duplicates using the delivery log, emails each previously unseen high/critical event to eligible recipients, and records each successful notification.

Use cases

• SaaS security operations: weekly/monthly executive summaries of Wazuh alert trends.
• Incident response: urgent high/critical notifications every few minutes without duplicate spam.
• Compliance-minded teams: role-based reporting with MITRE context and evidence samples, optionally as PDFs.

Technical details

• Credential requirement: add Wazuh Indexer HTTP B credentials.
• Core n8n logic: nodes such as if, set, code, and data table.
• Email delivery: email send (SMTP-based).
• Reporting helpers: uses flow notes (sticky note) and optional Gotenberg PDF rendering.