AI-Powered SOC Automation: Wazuh, n8n, TheHive & MISP

This course contains the use of artificial intelligence.

I only charge a fee solely for the time invested in building this comprehensive curriculum.

The Engineering Problem No One Teaches

There is a version of SOC work that looks like this: install Wazuh, watch an alert come in, open a ticket, close the ticket. Repeat. Courses that stop there produce practitioners who can operate tools but cannot build systems.

Then there is a version that looks like this: A suspicious execution alert enters a validated intake pipeline. It is normalized against a JSON Schema contract, deduplicated against existing cases, routed by severity, and passed to n8n. TheHive creates a structured case using a professional template with governance custom fields. Cortex runs scored enrichment against observables. MISP returns a CTI match from a curated, decay-policy-governed indicator set. An AI model drafts a triage summary — after the payload is redacted, prompt-injection filtered, grounded in an approved runbook, and validated against a structured output schema. A human analyst reviews the draft. An OPA policy gate approves the response action. Every step produces an audit log. The whole system has health checks, metrics, backup/restore evidence, and a sovereign data-flow map. That is what a production SOC automation engineer builds.

This course teaches the second version. All 100 labs of it.

The 100-Lab Journey: What You Are Actually Building

This is not a slide deck with screenshots. Every lab follows the same professional format: Outcome (what you can do after), Elevation (the difficulty jump explained in plain language), Safety (pre-flight checks, backup steps, and rollback commands before anything changes), Implementation (the actual work), Logic (what is happening under the hood), Verify (how you prove success), Troubleshoot (three professional fixes, not "Google it"), and Artifact (the deliverable you keep).

By Lab 100, your workspace contains a Git-versioned repository of production-oriented artifacts: schemas, workflows, detections, playbooks, policies, enrichment reports, AI audit logs, compliance evidence, and a full architecture review board packet.

Inside the Ten Modules

• Module 1 — Foundations (Labs 1–10) You build the engineering workspace, install the CLI toolkit, create a shared Docker network, define a JSON Schema alert data contract, build a synthetic alert generator, and complete the first end-to-end SOC loop: alert → validation → runbook → case stub. Before any service is deployed, you already understand what the data contract looks like and why it matters.

• Module 2 — Wazuh Detection Engineering (Labs 11–20) You deploy a Wazuh single-node stack, enroll a Linux agent, generate real telemetry (failed logins, FIM changes, privileged commands), write custom detection rules, test them with Wazuh logtest, map them to MITRE ATT&CK, and convert a Sigma rule into Wazuh logic. The module ends with a formal detection quality report — the kind you'd hand to a security architect.

• Module 3 — n8n SOAR-Style Orchestration (Labs 21–30) You deploy n8n with persistent storage, build a webhook-driven alert intake pipeline, normalize payloads against your JSON Schema, add severity routing, implement deduplication keys, configure retry/backoff logic, and design a dead-letter queue pattern. Automation here is engineering, not drag-and-drop optimism.

• Module 4 — TheHive Case Management (Labs 31–40) You deploy TheHive, create organizations and role-separated accounts, build a professional case template with structured tasks, add governance custom fields, create your first manual case from Wazuh evidence, generate API credentials for n8n integration, automate case creation with observables from alerts, and implement case deduplication. Analyst workflow quality is treated as an engineering deliverable.

• Module 5 — Cortex Enrichment and Safe Response (Labs 41–50) You deploy Cortex, connect it to TheHive, run safe IP and hash analyzers, build a custom analyzer skeleton with scoring and confidence fields, attach enrichment results to case decisions, design a reversible responder with approval and rollback requirements, and simulate a lab-only blocklist responder with full audit metadata. No response action in this course runs without a human approval gate.

• Module 6 — MISP Threat Intelligence and CTI Governance (Labs 51–60) You deploy MISP, create organizations and sharing groups, build structured IOC events, apply TLP/PAP/taxonomy tags and galaxy context, define a formal confidence and decay policy, query MISP from n8n for alert enrichment, design an observable promotion checklist (not every case observable belongs in CTI), and generate a Wazuh watchlist from approved indicators. Intelligence has a lifecycle here — not just an import button.

• Module 7 — AI-Assisted Triage with Guardrails (Labs 61–70) You define an AI boundary policy before touching a model. You build a prompt redaction script, a structured triage prompt template, a JSON output schema, a prompt-injection filter, a runbook retrieval step, a human review gate in n8n, and a JSONL AI audit log. The module makes one thing explicit: AI in this SOC drafts and assists — it does not command, execute, or approve.

• Module 8 — Detection-as-Code and Playbook-as-Code (Labs 71–80) You organize the engineering repository, add pre-commit quality checks, build schema test suites, create a detection sample library, write a detection review checklist, export and version n8n workflows as code, author a CACAO-style JSON playbook, document internal API contracts with OpenAPI, and generate an SBOM with a secret scan report. The SOC platform becomes a maintainable, reviewable engineering artifact.

• Module 9 — Hardening, Reliability, and Observability (Labs 81–90) You build an RBAC matrix across the full stack, create a secrets inventory with rotation plans, design and implement a TLS reverse proxy, write and test OPA/Rego approval policies, add health checks and workflow metrics, define a retention policy, and — critically — test backup and restore, not just backup creation. The platform is treated as a production service with operational controls.

• Module 10 — Sovereign Deployment and Capstone (Labs 91–100) You document a licensing and version matrix, design a sovereign data-flow map, build an offline deployment manifest for restricted-egress environments, define a restricted egress policy, create a decentralized research intake template, write a privacy-preserving CTI sharing procedure, assemble a compliance evidence pack, run a full end-to-end incident simulation, defend the design before a simulated architecture review board, and deliver the capstone.

Lab 100: The Capstone That Changes Your Career Trajectory

Lab 100 is not a quiz. It is not a project prompt with a suggested file name. It is a structured delivery of a complete sovereign AI-powered SOC automation platform — one that a hiring manager, CISO, or architecture review board can interrogate end-to-end.

The evaluator can do all of the following with your submission:

• Replay the synthetic incident from alert ingestion through case creation and closure, following a correlation ID through every hop in the pipeline.

• Inspect the TheHive case and find the alert evidence, observable enrichment reports, AI draft with review status, responder audit record, and closure checklist — all attached and timestamped.

• Verify that AI did not act autonomously by inspecting the AI audit log, the human review decision record, and the OPA policy that would have blocked any unapproved response.

• Test the backup and restore path by checking the documented restore order and confirming the restored workflow matches the original.

• Read the architecture review board packet and find the threat model, trust boundaries, failure modes, compliance evidence index, reliability metrics, known limitations, and improvement backlog — honestly documented.

This is the artifact that answers the interview question: "Have you ever built something from end to end?" with a repository link and a demonstration recording.

Why This Matters Right Now

The 2026 SOC environment runs on API-driven workflows, CTI governance, and automation platforms. Organizations increasingly need engineers who can design alert contracts, build reliable orchestration, govern AI use, produce compliance evidence, and explain architecture tradeoffs — not just operate dashboards. This curriculum was built around that reality, not around the tool stack that existed five years ago.

The tools in this course — Wazuh, TheHive, Cortex, MISP — are open-source-friendly and widely deployed in enterprise, MSSP, CERT, and CSIRT environments globally. n8n is self-hostable. None of this requires a cloud subscription, a vendor trial, or a budget approval. You need a laptop with enough RAM and the willingness to work through 100 structured labs.

Enroll Now — The Workspace Is Ready in Lab 1

Lab 1 takes ten minutes. By the end of it you have a versioned workspace, a README, and the first Git commit of a repository that you'll still be using in Lab 100. The architecture review board packet will reference that commit. Start there.