Shuffle: automation features and setup

Overview

Shuffle connects security tools into workflows, so an incident received from one system can trigger checks and gather information from other systems. The project also presents itself as suitable for security service providers serving multiple customers. Self-hosting gives you control over the infrastructure, but also makes you responsible for updates and availability. To get started, choose a simple event and build a short sequence around it that can be verified manually.

Features

• Automation workflows for connecting security operations tools.
• A cloud option alongside code and instructions for self-hosting.
• Integration of events and Webhooks with external security systems.

Business uses

• Enrich a suspicious indicator with information from external analysis tools.
• Create a sequence of checks when an incident is opened in an incident management system.

Getting started

• Choose cloud or self-hosting and set aside an isolated test environment.
• Connect one event and one analysis service using read permissions.
• Check service errors, missing data, and data isolation before expanding to more customers.

What to check

• For self-hosting, plan for infrastructure storage, backups, and monitoring, not just workflow monitoring.
• In a multi-customer setup, verify that permissions and data are separated for each customer, including in run logs.