Connecting Shuffle SOAR to the detection, threat intelligence and secrets systems around it, using the inbound webhook and extension patterns Shuffle and its partners document.
Automating Wazuh alert response with Shuffle: forwarding alerts by level to a workflow webhook, scaling past 10 alerts per second, enrichment and ticketing steps, and triggering Wazuh active response on agents from playbooks.
Streaming MISP event and attribute updates into Shuffle through the ZMQ forwarder extension, then pushing indicators to firewalls, EDR and SIEM watchlists, and where the forwarder should run at scale.
Keeping playbook credentials out of Shuffle's own database by referencing an external key management system: kms/ path references, the IAM app and Get KMS key action it needs, and failure handling.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.