SOAR integration

[rock-kobs]

has anyone use securityonion with SOAR, specifically Shuffle, if yes, can you explain how.
any other soar tool is okay its just that its one of those you can host locally and play with that is free, i want to know how, i know python can be used to query es logs in securityonion but with SOAR you get so many apps in one place.
this question is for the developers, when can we see SOAR integration in future like Siemonster which has integrated Shuffle. Currently am trying to see how the two siems can work together either by cloning some key datasets from Securityonion into Siemonster. just had some time to play around, anyway thanks in advance.

[weslambert]

I have done this before (with n8n), and have written about it in a blog post here:

https://wlambertts.medium.com/zero-dollar-detection-and-response-orchestration-with-n8n-security-onion-thehive-and-10b5e685e2a1.

While the article could be updated, the accompanying Github project has already been updated. I plan on updating the existing article, and releasing an article around usage with Shuffle very soon.