Wazuh Health Check n8n Workflow: SSH & Email HTML Report

Run a Wazuh Health Check in minutes—complete with SSH sampling, a scored Green/Yellow/Red result, and an HTML email report

This Wazuh Health Check n8n Workflow performs a manual health assessment of your Wazuh deployment by pulling live data from the Wazuh Manager API, Wazuh Indexer API, and your Wazuh host via SSH. It then scores the findings, generates prioritized recommendations, stores a baseline in an n8n Data Table, and emails an HTML report via SMTP.

What this workflow does

• Manual trigger: You run it on demand from n8n.
• Wazuh Manager API checks: Retrieves manager info, process status, manager statistics, daemon statistics, agent connectivity summary, and cluster health.
• Wazuh Indexer API checks: Collects cluster health, shard/allocation status, disk allocation, and node pressure signals (CPU/load, heap, and RAM usage).
• SSH host sampling: Measures Linux CPU, memory, disk, inode usage, uptime, and—when present—Docker container state and health.
• Baseline + scoring: Loads the most recent stored run from the n8n Data Table and evaluates results against configurable thresholds to compute an overall Green/Yellow/Red status, a weighted health score, and prioritized recommendations.
• Store and report: Saves current metrics and comparison data back to the Data Table, then sends the formatted HTML health report via email send (SMTP).

Use cases

• Proactively validate Wazuh health before planned changes or upgrades
• Operational monitoring for SaaS operators managing multiple Wazuh environments
• On-demand incident triage with a single, scored report and next-step recommendations

Technical details

• Integrations: Wazuh Manager API (HTTP Basic Auth), Wazuh Indexer API (HTTP Basic Auth)
• Transport: SSH to a Wazuh host
• n8n nodes / components: set, ssh, code, data table, email send, plus a sticky note for workflow clarity