Shuffler: Open Source SOAR Tool

I recently found out about Shuffler, it’s an open source SOAR tool. SOAR stands for Security Orchestration, Automation and Response. It allows you to automate a lot of workflows that you normally would do manually to help you be more efficient and remove some of the repetitive tasks that keep you busy during the day.

Shuffler does just that! It allows you to integrate with your security tooling in order to accomplish tasks.

Shuffler is flexible in how you deploy it, they have self-hosted options and cloud SaaS options. There is even a free version that you can once again either host yourself or use on the Shuffler cloud.

You can take a look at Shuffler here: https://shuffler.io

These days, the idea of something free is very rare to come by, so…

What do you get with the free Shuffler cloud plan?

• 10,000 Application Executions, that refresh each month
• Use of any application
• Unlimited Users
• Unlimited Workflows
• Free Support and Discord access
• 1GB of Shuffle Datastore (cache)
• 1GB of File Storage
• 30 SMS alerts per month
• 100 Email alerts per month

This is actually not bad at all with what you’re getting for free, the main limitations here are probably going to be on the alerts. Depending on what you’re ingesting through your workflows, you’re going to run out of alerts fairly fast. Here is an example, let’s say you are working on getting information from your Security Information and Event Manager (SIEM). Each time Shuffler processes a SIEM alert, it sends an email to create a ticket for your helpdesk. Well, I can see how within a single week you could chew through the 100 Email alerts. This once again depends on how busy you are, and what you’re doing with each workflow.

Now, let’s take a look at what you get with the base enterprise plan

The base price for enterprise is $180 per month, and it goes up from there, the max cost before you need to request a quote is $1620 per month.

What do you get with Shuffler enterprise?

• 100,000 – 900,000 (Depends on your monthly plan)
• Priority Support
• Multi-Tenant
• Multi-Region Tenants
• Help with Workflow and App development
• Unlimited Users
• Unlimited Apps
• Unlimited Workflows
• Unlimited Suffle Datastore (cache)
• Unlimited File Storage
• 300 SMS alerts per month
• 10,000 Email alerts per month

There are a few more things that you get over the free version with the enterprise, such as uptime SLAs, and the retention periods for information.

Mind you, everything I have been speaking about up until this point has been for the SaaS version. Interestingly enough, it looks like the for the Self-Hosted, you get very similar notification limitations. I’m not exactly sure how it does the SMS portion, I don’t know if you would need to connect to the Shuffler servers in order for that function to work. Either way, I think that for a free SOAR tool offering, and the fact that it is Open Source, you get a good bit to get you started.