Pages on Shuffle capabilities beyond basic playbooks: incident and case management, workflow triggers and human approvals, AI agents with local models, and the detection rule manager.
Using Shuffle's built-in incident workspace instead of a separate ticketing tool: alert ingestion by webhook or polling, OCSF records, observable extraction and TLP tags, and running response playbooks from a case.
Choosing how Shuffle playbooks start and pause: webhooks, schedules, subflows and user input steps that wait for an analyst to approve containment, and which triggers work on self-hosted versus Cloud or hybrid.
Running Shuffle AI agents and MCP tools against self-hosted models through Ollama or vLLM so alert data stays inside the network, versus routing inference to Shuffle Cloud credits, plus approvals and execution traces.
Managing Sigma and other detection rules centrally with the Shuffle Detection Manager beta and Tenzir pipelines: the Orborus requirements, log forwarding and how it complements rather than replaces your SIEM.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.