Wazuh_Alert_Investigation 副本

• •HTTP Webhook 端点（n8n 会自动生成）
• •Telegram Bot Token
• •OpenAI API Key

{
  "id": "",
  "meta": {
    "instanceId": "",
    "templateCredsSetupCompleted": true
  },
  "name": "Wazuh_Alert_Investigation 副本",
  "tags": [
    {
      "id": "",
      "name": "Github",
      "createdAt": "2025-07-08T08:24:29.609Z",
      "updatedAt": "2025-07-08T08:24:29.609Z"
    }
  ],
  "nodes": [
    {
      "id": "",
      "name": "如果",
      "type": "n8n-nodes-base.if",
      "position": [
        240,
        -20
      ],
      "parameters": {
        "options": {
          "ignoreCase": true
        },
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": false,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "",
              "operator": {
                "name": "filter.operator.equals",
                "type": "string",
                "operation": "equals"
              },
              "leftValue": "={{ $json.body.severity }}",
              "rightValue": "1 low"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "",
      "name": "Wazuh 警报",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -20,
        -20
      ],
      "webhookId": "",
      "parameters": {
        "path": "",
        "options": {
          "rawBody": true
        },
        "httpMethod": "POST"
      },
      "typeVersion": 2
    },
    {
      "id": "",
      "name": "无操作",
      "type": "n8n-nodes-base.noOp",
      "position": [
        260,
        200
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "",
      "name": "调查摘要",
      "type": "@n8n/n8n-nodes-langchain.chainSummarization",
      "position": [
        540,
        -40
      ],
      "parameters": {
        "options": {
          "summarizationMethodAndPrompts": {
            "values": {
              "prompt": "You are the experinced SOC AI Analyst designed by Mariskarthick M, Analyse the following and provide the detailed investigation with the below mentioned format.\n\n\"{text}\"\n\nconicise summary",
              "combineMapPrompt": "You are the experinced SOC AI Analyst designed by Mariskarthick M, Analyse the following and provide the detailed investigation with the below mentioned format.\n\n#Analyse:\n{{ $json.body.all_fields.full_log }}\n\n#Format:\nAlert Name: \nAlert Description: (describe about that alert)\nMitre Tactic & Technique\nImpacted Scope: Source IP, Destiantion IP, Host Machine\n\nExternal Artificats Reputation check:\n\nAnalysis:\n\nSecurity Recommendations.\n\nPlease make the investigation report in organized way and each fields line by line.\n {{ $json.body }}"
            }
          }
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "",
      "name": "SOC 团队",
      "type": "n8n-nodes-base.telegram",
      "position": [
        920,
        -20
      ],
      "webhookId": "",
      "parameters": {
        "text": "={{ \n  $json.output.text\n    .replaceAll('\\\\', '')                       // Remove escape slashes\n    .replaceAll('*', '')                        // Remove Markdown stars\n    .replaceAll('#', '')                        // Remove Markdown headers\n    .replaceAll('_', '')                        // Remove underscores\n    .replaceAll('[', '')                        // Remove leftover brackets\n    .replaceAll(']', '')                        // Remove closing brackets\n    .replaceAll('(', '(')                       // Retain parentheses\n    .replaceAll(')', ')')\n    .replaceAll('`', '')                        // Remove backticks\n    .replaceAll('  ', ' ')                      // Extra space trim\n    .replaceAll('\\n\\n', '\\n')                   // Collapse double newlines\n    .replaceAll('\\n ', '\\n')                    // Remove leading spaces on lines\n    .replaceAll(' - ', ' — ')                   // Optional: replace dash with em dash for clarity\n    .trim()\n}}\n",
        "chatId": "",
        "additionalFields": {
          "appendAttribution": true
        }
      },
      "credentials": {
        "telegramApi": {
          "id": "",
          "name": ""
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "717713de-4a80-4b51-910c-3b6a588e2f56",
      "name": "定制 AI 模型",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        560,
        200
      ],
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4o-mini"
        },
        "options": {}
      },
      "credentials": {
        "openAiApi": {
          "id": "",
          "name": "OpenAi account"
        }
      },
      "typeVersion": 1.2
    }
  ],
  "active": false,
  "pinData": {},
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "2f2786be-474f-4ab6-a41e-391e7427d022",
  "connections": {
    "If": {
      "main": [
        [
          {
            "node": "Investigation Summarization",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No Operations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wazuh Alert": {
      "main": [
        [
          {
            "node": "If",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Customized AI Model": {
      "ai_languageModel": [
        [
          {
            "node": "Investigation Summarization",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Investigation Summarization": {
      "main": [
        [
          {
            "node": "SOC Team",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}