Automated Security Incident Reporting for Security Operations Centers Using n8n and Large Language Models

Security Operations Center (SOC) analysts face a critical operational bottleneck driven by alert fatigue, with organizations averaging 4,484 security alerts per day, of which 83% are false positives, compounded by the persistent inefficiency of manual incident reporting. This study proposes an automated security incident reporting system that aggregates logs collected by Wazuh from Suricata, Trivy, and Falco, through the n8n workflow platform and uses a Large Language Model (LLM) AI agent with structured 5W+1H prompt engineering to transform raw unstructured log data into standardized daily incident reports. Generated reports are rendered as PDF documents via Gotenberg and distributed automatically through Telegram. The system was evaluated across nine simulation scenarios encompassing active attacks including PHP Remote Code Execution, PostgreSQL CVE-2019-9193, MySQL CVE-2012-2122, SSH Brute Force, a Full Cyber Kill Chain with C2 tunneling, and multi-actor concurrent attack environments, as well as benign administrative activity scenarios. The evaluation yielded an accuracy of 89.09%, precision of 97.22%, recall of 87.50%, and F1-score of 92.11%. End-to-end processing averaged 21.003 seconds per report, with the LLM module contributing 73.6% of total execution time. These results confirm that the proposed architecture reliably reduces analyst cognitive load while maintaining high incident classification precision.