n8n — Automatisation de Workflows SOC

n8n     Low-code/no-code gnral 400 intgrations UI trs accessible
Shuffle  SOAR spcialis scu apps security natives VQL support
Usage SOC 
  n8n     Workflows simples notifications enrichissement rapide
  Shuffle  Orchestration complexe rponse automatise avance
  Les deux peuvent coexister dans un SOC

# docker-compose.yml
services:
  n8n:
    image: n8nio/n8n:latest
    ports:
      - "5678:5678"
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=ChangeMe!2026
      - N8N_HOST=localhost
      - N8N_PORT=5678
      - N8N_PROTOCOL=http
      - WEBHOOK_URL=http://localhost:5678/
      - GENERIC_TIMEZONE=Europe/Paris
      - N8N_ENCRYPTION_KEY=votre_cle_32_chars_aleatoire
    volumes:
      - n8n_data:/home/node/.n8n
volumes:
  n8n_data:

# Accès : http://localhost:5678
# Login : admin / ChangeMe!2026

Workflow  Squence de nodes connects
Node      Bloc daction HTTP request IF Webhook Email
Trigger   Node de dpart Webhook Schedule Email
Credential  Config scurise daccs aux APIs

Trigger  Webhook
  URL  http//n8n5678/webhook/wazuh-alerts
  Method  POST
  
Node  IF Condition
  Level > 10 
   Oui                     Non
Node  TheHive HTTP      Node  Slack message simple
  POST /api/v1/case          #soc-info
  title Alert            "ℹ️ Alerte niveau {{level}}"
  
Node  Slack #soc-alerts)
  "🚨 Case créé #{{case_id}}"

// Configuration node HTTP Request → TheHive
{
  "method": "POST",
  "url": "http://thehive:9000/api/v1/case",
  "authentication": "predefinedCredentialType",
  "nodeCredentialType": "httpHeaderAuth",
  "sendHeaders": true,
  "headerParameters": {
    "Authorization": "Bearer {{$credentials.token}}"
  },
  "sendBody": true,
  "contentType": "json",
  "body": {
    "title": "Wazuh: {{$json.rule.description}}",
    "severity": 2,
    "tags": ["wazuh", "auto"],
    "description": "Agent: {{$json.agent.name}}\nRule: {{$json.rule.id}}\nLevel: {{$json.rule.level}}"
  }
}

Trigger  Schedule tous les jours  
  
Node  HTTP Request  Wazuh API
  GET /security/eventslimit100&level10
  alertes niveau 10 des dernires 
  
Node  HTTP Request  TheHive API
  GET /api/v1/casestatusOpen
  cases ouverts
  
Node  HTTP Request  MISP API
  GET /events/restSearchlast
  nouveaux events MISP
  
Node  Code JavaScript
  Assembler le rapport 
   Rapport SOC  $today}
  Alertes Wazuh lvl 10  alerteslength
  Cases TheHive ouverts    caseslength
  Nouveaux events MISP     misplength
  
Node  Email  Slack
  Envoyer le rapport  #soc-daily

Trigger  Webhook TheHive cre un observable
  
Node  Switch type dobservable
  ip  AbuseIPDB  VirusTotal
  domain  URLScanio  VirusTotal
  hash  VirusTotal
  
Node  HTTP Request  API enrichissement
  
Node  Code  Calculer score de risque
  score  0
  if vt_positifs > 5 score  50
  if abuse_score > 70 score  30
  if urlscan_malicious score  20
  
Node  IF score > 60
   Oui                         Non
TheHive  Update observable    TheHive  Add tag "benign"
  tag "malicious"
  note "Score: {{score}}"
  
Slack  "#soc-ioc — IOC {{value}} score {{score}}/100"

# Dans n8n : Settings > Credentials > Add Credential
TheHive 
  Type  Header Auth
  Name  X-Organisation-API-Key ou Authorization
  Value  Bearer THEHIVE_API_KEY
MISP 
  Type  Header Auth
  Name  Authorization
  Value  MISP_API_KEY
Wazuh 
  Type  Basic Auth
  User  wazuh-wui
  Password  WAZUH_PASSWORD
Slack 
  Type  OAuth2 ou Webhook URL
  Webhook URL  https//hooks.slack.com/services/XXX
VirusTotal 
  Type  Header Auth
  Name  x-apikey
  Value  VT_API_KEY

Trigger  Email IMAP  bote phishingcompanycom
  
Node  Extract Email Data
  from subject body attachments URLs
  
Node  HTTP  URLScanio analyser chaque URL
  
Node  IF URL malveillante
   Oui
  Node  MISP  Crer event domain malveillant
  Node  TheHive  Crer case "Phishing signalé"
  Node  Email  Rpondre  lutilisateur
    Merci pour le signalement Email confirm malveillant
     Ne pas cliquer sur les liens Rapport en cours
   Non
  Node  Email  Rpondre
    "Merci. Email analysé, aucune menace détectée."

// Node Code — Parser une alerte Wazuh
const alert = $input.first().json;
return [{
  json: {
    title: `Wazuh Alert: ${alert.rule?.description}`,
    agent: alert.agent?.name || 'unknown',
    ip: alert.data?.srcip || alert.agent?.ip,
    level: alert.rule?.level,
    ruleId: alert.rule?.id,
    timestamp: alert.timestamp,
    severity: alert.rule?.level >= 12 ? 3 : alert.rule?.level >= 8 ? 2 : 1,
  }
}];

// Node Code — Formatter rapport Markdown
const alerts = $('Wazuh-Alerts').all();
const cases = $('TheHive-Cases').all();
const report = `## 📊 Rapport SOC — ${new Date().toLocaleDateString('fr-FR')}
**Alertes critiques (24h):** ${alerts.length}
**Cases ouverts:** ${cases.length}
### Top alertes:
${alerts.slice(0,5).map(a =>
  `- [${a.json.rule?.level}] ${a.json.rule?.description}`
).join('\n')}`;
return [{ json: { report } }];