{
  "name": "Automated URL phishing & threat analysis with NixGuard AI",
  "nodes": [
    {
      "id": "6f7ace63-a7d6-498e-9805-3de8f00b4275",
      "name": "Execute NixGuard & Wazuh Workflow",
      "type": "n8n-nodes-base.executeWorkflow",
      "position": [
        -420,
        -1220
      ]
    },
    {
      "id": "da86d2fb-89ab-4431-a6a9-6ccbd0f66121",
      "name": "Format NixGuard AI Summary & Wazuh Insights",
      "type": "n8n-nodes-base.set",
      "position": [
        -200,
        -1220
      ]
    },
    {
      "id": "c0ac70b6-0545-4681-af88-e3baae9d658e",
      "name": "(Optional) Send Slack Alert for High-Risk Events",
      "type": "n8n-nodes-base.slack",
      "position": [
        40,
        -1220
      ]
    },
    {
      "id": "64dfc08c-5b6c-4982-b779-ab368cfabc73",
      "name": "Webhook Trigger\n(REAL-WORLD USE)1",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -640,
        -980
      ]
    },
    {
      "id": "2b8da30e-22d6-4900-bc3d-37c5a4cfb3c4",
      "name": "Set API Key & Initial Prompt",
      "type": "n8n-nodes-base.set",
      "position": [
        -640,
        -1220
      ]
    },
    {
      "id": "c22b6b46-ee9a-4ed5-82ef-d693f7e1b7b3",
      "name": "Next Steps: Automate Response2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -200,
        -1000
      ],
      "parameters": {
        "width": 520,
        "height": 380,
        "content": "### ⚡️ Next Steps: Automate Your SOC/IR Process\n\nThis workflow delivers actionable intelligence. The `Set` node formats the powerful insights from NixGuard and Wazuh, ready to fuel your SOAR playbooks"
      }
    },
    {
      "id": "5794f296-fa9a-4b6e-a6fa-eef14f78b225",
      "name": "Workflow Overview2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1280,
        -1220
      ],
      "parameters": {
        "width": 540,
        "height": 440,
        "content": "### 🎯 Workflow Overview: The Dispatcher\n\nThis workflow acts as a **Dispatcher**. Its only job is to provide an input (like an IP address) and an API key to trigger your main, more complex analysis wor"
      }
    },
    {
      "id": "a8687553-569a-41cf-8ab3-175a031ad6db",
      "name": "Setup Instructions2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -640,
        -1740
      ],
      "parameters": {
        "width": 560,
        "height": 440,
        "content": "### ⚙️ Critical Setup: Go Live in 2 Steps\n\nThis template is a 'dispatcher' and requires two actions to function correctly.\n\n1️⃣ **Add Your API Key:**\n   - Click the blue **`Set API Key & Initial Promp"
      }
    }
  ],
  "connections": {
    "Set API Key & Initial Prompt": {
      "main": [
        [
          {
            "node": "Execute NixGuard & Wazuh Workflow",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Execute NixGuard & Wazuh Workflow": {
      "main": [
        [
          {
            "node": "Format NixGuard AI Summary & Wazuh Insights",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format NixGuard AI Summary & Wazuh Insights": {
      "main": [
        [
          {
            "node": "(Optional) Send Slack Alert for High-Risk Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}