DEVELOPMENT OF AN AGENT FOR NOTIFICATION ANALYSIS BASED ON ARTIFICIAL INTELLIGENCE USING N8N AND ELASTIC SECURITY SOFTWARE

Abstract

This article presents a research-driven approach to enhancing the efficiency of incident response within Security Operations Centers by implementing an automated event analysis system that integrates the n8n platform and large language models. This approach addresses modern cybersecurity challenges, including the continuous increase in the number of security alerts, the growing complexity of IT infrastructures, limited human resources, and the declining effectiveness of manual analysis. The developed architecture incorporates the Elastic Security SIEM system as the primary event source, n8n as the orchestration platform for workflow management, LLM-based agents for natural-language interpretation of incidents, and external enrichment services such as AbuseIPDB and VirusTotal. The core system functions include automated collection, normalization, and enrichment of security events, risk scoring, incident type classification, generation of concise analytical summaries in the 5W format (Who, What, When, Where, Why), and automatic creation of relevant response actions. To validate the effectiveness of the proposed approach, a comprehensive experimental study was conducted, encompassing several stages: simulation of real SOC scenarios, generation of representative security incidents, execution of the automated analysis workflow, and comparison of results with the performance of Tier-1 SOC analysts. Particular attention was paid to assessing the stability of the LLM agent under varying event formats, different log sources, and inconsistent data quality. Furthermore, the system’s behavior was examined in scenarios involving ambiguous or partially missing incident attributes, as well as its resilience to noisy or incomplete data. The analysis demonstrated that the integrated approach not only automates routine tasks but also ensures high consistency of decisions, minimizes subjective variability inherent to manual analysis, and supports the production of unified and repeatable incident verdicts. Additional evaluation focused on the quality of the generated analytical summaries, the accuracy of contextual interpretation, the model’s ability to identify key entities and causal factors, and the relevance of recommended response actions. The study also verified the system’s compatibility with existing SOC infrastructure and its ability to scale under increased alert volumes without significant performance degradation. The obtained results confirm that the proposed system not only enhances the speed and quality of incident response but also lays the foundation for transitioning from a reactive to a proactive SOC model, where automated tools take over a substantial portion of the cognitive workload. Due to the modularity of n8n and the flexibility of LLM agents, the system can adapt to new threat types, expand functionality without significant cost, and integrate with various corporate services. Thus, it provides the technological basis for further adoption of intelligent automation in cybersecurity practice and supports the development of next-generation SOC environments.