Shuffle
Open source SOAR from Oslo that you can self-host or run in the cloud
Quick Overview
| Company | Shuffle AS |
|---|---|
| Category | SOAR and Security Automation Platforms |
| Headquarters | Oslo, Norway, Norway |
| Founded | 2019 |
| EU Presence | Yes - Norway (EEA) |
| Data Location | Self-hosted on your own servers, or the hosted cloud at shuffler.io (region not stated on pages read) |
| Open Source | AGPL-3.0 |
| GDPR Compliant | Yes |
| Self-Hosting | Yes, installation guide on GitHub |
| Main Features | Visual workflow builder, webhooks, app integrations, self-hosted or cloud, MSSP use, training |
| Pricing | Hosted plans and support: see website (pricing page is rendered client-side) |
| Best For | Security teams and MSSPs that want an open source SOAR they can run themselves |
| Replaces | Palo Alto Cortex XSOAR, Splunk SOAR |
Detailed Review
Shuffle describes itself as an open source automation platform built for and by security professionals, and the README says it is designed to work well with MSSPs and other service providers. The repository carries the GNU Affero General Public License v3.0, so the core can be read, modified and deployed on your own infrastructure.
The Norwegian business register lists Shuffle AS in Oslo, registered in July 2019 with computer programming as its activity, and the GitHub organisation gives Oslo as its location. The README offers two routes: a self-hosted installation guide, or registration for the cloud service at shuffler.io.
Self-hosting and cloud
The GitHub README points to an installation guide for self-hosting and to a registration page for the cloud. The product is also listed in the Google Cloud and AWS marketplaces according to the badges at the top of the README.
Running it yourself keeps workflow definitions and stored credentials on your own servers. The hosted version is a different trade-off, and the pages we could read do not state its hosting region.
Community and support
Support routes named in the README are Discord, email and a contact page for demo calls, plus a training page. The README also invites sponsorship of the project through GitHub Sponsors, which suggests a small core team.
Teams that want case handling next to automation often pair a SOAR like this with TheHive, and the README itself links to blog posts on connecting Shuffle to TheHive and Cortex.
Fit against Cortex XSOAR
Cortex XSOAR's site markets prebuilt content packs and a visual playbook editor. Shuffle covers the workflow side with an open source core, but a large curated content marketplace is a commercial strength that we could not compare on the pages read.
Limitations to Consider
The pricing page renders client-side, so plan prices could not be read. The company's own legal entity text is not shown on the pages we could read, so the link between shuffler.io and Shuffle AS rests on the register entry and the GitHub organisation's Oslo location. AGPL-3.0 has obligations if you modify and offer it as a network service. Teams wanting packaged case management should look at TheHive.
Who Should Use Shuffle
Technical SOC teams and MSSPs that are comfortable operating their own deployment and want to avoid a proprietary SOAR licence.
Pros and Cons
Pros
- Core code under AGPL-3.0
- Self-hosting guide published
- Norwegian company in the EEA
- Aimed at MSSP and service-provider use
- Public GitHub project with community channels
Cons
- Pricing not readable on the pages checked
- Hosting region of the cloud not stated
- Small team visible from the README
- AGPL obligations apply to modified network services
Alternatives to Shuffle
Other European soar and security automation platforms worth comparing before you decide:
SecureVisio
Poland · SIEM, SOAR and UEBA in one platform from Rzeszow
TheHive
France · Incident response case platform with native Flow automation
Tines
Ireland · No-code workflow automation used by security and IT teams
Guardsix (formerly Logpoint)
Denmark · SOAR that runs inside the same self-hosted sovereign platform
See all European soar and security automation platforms or compare them directly against Palo Alto Cortex XSOAR on our alternatives page.
Frequently Asked Questions
The code is published under AGPL-3.0 and can be self-hosted. The README also points to a hosted cloud service, but its prices could not be read because the pricing page renders client-side.
The GitHub organisation is located in Oslo, Norway, and the Norwegian business register lists Shuffle AS in Oslo, registered on 9 July 2019 with computer programming services as its activity.
The project README links to blog posts on integrating Shuffle with VirusTotal, TheHive, Cortex and MISP, so those integrations are documented by the project.