Otomatisasi Pelaporan Insiden Keamanan Berbasis n8n dan Large Language Model

Dzaki Maulana Asif, Ir. Nur Rohman Rosyid, S.T., M.T., D.Eng., IPM.

2026 | Tugas Akhir | D4 TEKNOLOGI JARINGAN

Security Operations Center (SOC) modern menghadapi tekanan kritis berupa rata-rata 4.484 notifikasi harian dengan 83% merupakan false positive, diperparah pelaporan insiden manual yang masih dijalankan 69% SOC. Kondisi ini memicu alert fatigue hingga 44 hingga 63% praktisi keamanan mengalami burnout sehingga meningkatkan human error yang dieksploitasi penyerang. Penelitian ini mem bangun arsitektur orkestrasi pelaporan insiden otomatis dengan mengintegrasikan n8n, Wazuh, dan Large Language Model (LLM) berbasis API OpenAI. Log dari Suricata, Trivy, Falco, dan Wazuh diagregasi terjadwal oleh n8n lalu ditransforma sikan AI Agent berbasis rekayasa prompt 5W+1H menjadi laporan harian PDF yang didistribusikan otomatis melalui Telegram. Evaluasi pada lingkungan virtual menggunakan metrik Accuracy, F1-Score, dan processing time terhadap 55 titik data dari sembilan skenario pengujian dengan lima iterasi menghasilkan nilai Ac curacy sebesar 89,09%, Precision sebesar 97,22%, Recall sebesar 87,50%, dan F1-Score sebesar 92,11%. Sistem menyelesaikan satu siklus pelaporan dalam rerata 21,003 detik dengan modul LLM mendominasi 73,6% total waktu eksekusi. Temuan ini membuktikan bahwa orkestrasi LLM mampu mendelegasikan beban triase harian kepada kecerdasan buatan secara andal, sehingga analis dapat mengalihkan fokus pada penguatan strategi pertahanan siber.

Modern Security Operations Centers (SOC) face critical pressure from an average of 4,484 daily notifications, 83% of which are false positives, compounded by manual incident reporting still practiced by 69% of SOCs. This condition trig gers alert fatigue, with 44 to 63% of security practitioners experiencing burnout, thereby increasing human error that attackers actively exploit. This research builds an automated incident reporting orchestration architecture by integrating n8n, Wazuh, and a Large Language Model (LLM) powered by the OpenAI API. Logs from Suricata, Trivy, Falco, and Wazuh are aggregated on a scheduled basis by n8n and subsequently transformed by an AI Agent using 5W+1H prompt engineering into daily PDF reports distributed automatically via Telegram. Evaluation con ducted in a virtual environment using Accuracy, F1-Score, and processing time met rics across 55 data points derived from nine test scenarios with five iterations yielded an Accuracy of 89.09%, Precision of 97.22%, Recall of 87.50%, and an F1 Score of 92.11%. The system completed one full reporting cycle in an average of 21.003 seconds, with the LLM module dominating 73.6% of total execution time. These findings demonstrate that LLM orchestration can reliably delegate daily tri age workloads to artificial intelligence, enabling analysts to redirect their focus toward strengthening cybersecurity defense strategies. 

Kata Kunci : Orkestrasi Keamanan,Pelaporan Insiden Otomatis,Large Language Model,n8n,Wazuh,Alert Fatigue