Building an Autonomous SOC with TheHive, Cortex & Shuffle

Modern security operations centers face a genuine crisis: they’re drowning in alerts. Your analysts spend six to seven hours every single day on repetitive triage work—copy-pasting IP addresses into VirusTotal, checking file hashes, clicking through the same manual lookups over and over. Meanwhile, the serious threats that demand human judgment and creativity sit in the queue, waiting.

Commercial SOAR platforms claim to solve this problem. Palantir XSOAR, Splunk SOAR, IBM QRadar SOAR—they all promise automation that will free up your team. The catch? You’ll pay $50,000 to $300,000 per year in licensing alone. That’s before you factor in implementation consulting, customization, and the inevitable vendor lock-in that makes switching later nearly impossible.

There’s a better way. It’s open-source, battle-tested across mid-market and enterprise environments, and it costs a fraction of what commercial platforms demand. It consistently outperforms commercial alternatives in flexibility, data sovereignty, and total cost of ownership.

If your team has Linux and Docker skills—and increasingly, they should—this is your blueprint.

The Architecture: Three Platforms, One Autonomous SOC

This stack brings together three purpose-built platforms that work together seamlessly to create a closed-loop incident response system:

Platform	What It Does
TheHive 5	Incident case management—the command center where every incident begins and ends
Cortex	Automated observable enrichment—it looks up IPs, domains, file hashes against threat intelligence sources automatically
Shuffle	Orchestration and automation—it decides what happens next based on analysis results, then makes it happen

The critical insight here is understanding what each tool does—and what it doesn’t. Too many teams conflate these roles, leading to redundant work and fragile integrations.

Think of it this way: Shuffle is the pipe. Cortex is the scalpel. TheHive is the brain.

When your SIEM detects a suspicious IP address, here’s what happens:

Shuffle catches the alert, extracts the relevant details (the IP, the source, severity), and decides what to do with it
Cortex takes that IP and instantly enriches it—checking VirusTotal, AbuseIPDB, Shodan, your threat intelligence platform, and a dozen other sources in parallel
TheHive receives a fully triaged, fully enriched case that presents all the context to your analyst right away

Your analysts aren’t hunting for information—the system already found it.

TheHive 5: Your Incident Operations Center

TheHive is where your analysts live. It’s the single place they go to see every incident, collaborate on cases, and track the entire investigation from first alert to resolution.

What TheHive Needs to Run

Behind the scenes, TheHive requires three infrastructure components:

Component	What It Does	Options
Cassandra	Stores all your case data, investigations, and alerts	ScyllaDB if you need higher performance
Elasticsearch	Lets you search and filter through millions of alerts quickly	OpenSearch works just as well
File Storage	Holds evidence files, attachments, and observable data	MinIO, NFS, AWS S3, or local disk

How TheHive Organizes Information

TheHive follows a simple but powerful hierarchy that mirrors how incidents actually unfold:

Alert (the raw signal from your SIEM)
  └── Case (the investigation you open because of that alert)
        ├── Tasks (work items: verify authenticity, check for lateral movement, etc.)
        ├── Observables (the actual artifacts: IPs, domains, hashes, email addresses)
        │     └── [Cortex analysis results get attached here automatically]
        └── TTPs (MITRE ATT&CK technique tags so you know what the attacker was trying to do)

This structure is intentional. It maps directly to how your analysts actually work.

TheHive Licensing: What You Actually Need

TheHive offers different tiers depending on how you plan to use it:

License	Cost	What You Get
Community	Free	Perfect for single organizations, unlimited users, no SSO, no failover clustering
Gold	€500/month	High availability, Active Directory integration, better for teams that need it
Platinum	€1,000/month	Everything in Gold, plus some multi-tenancy features
MSSP	Custom pricing	Full multi-tenancy for managed security service providers running multiple client environments

The honest answer: If you’re a single organization with a reasonably sized security team, Community covers production use cases just fine. You get unlimited users, full case management, and all the core features. Where you’ll hit limits is when you need Active Directory integration for your 200-person company, or when you’re running it across multiple client environments and need hard tenant separation. That’s when you move to Platinum or MSSP.

TheHive’s Core Strengths

Real-time collaboration — When an analyst adds evidence or completes a task, every other analyst on that case sees it immediately, without refreshing the page. No more “did you see that comment?” Slack messages.

TLP and PAP classification — Built-in intelligence sharing controls. You tag information with Traffic Light Protocol (TLP:Amber, TLP:Red, etc.) and Privacy Protocol rules, and TheHive enforces those constraints. You can’t accidentally leak classified intelligence to a partner who shouldn’t see it.

Smart alert templates — Define what a phishing investigation looks like—standard tasks, required observable types, evidence fields. When that alert comes in, TheHive pre-populates the case structure. No more inventing the process from scratch every time.

Automated notifications — When case severity changes or a task completes, TheHive can automatically notify Shuffle, post to Slack, or trigger a PagerDuty escalation. You decide the rules.

Full API access — Everything in TheHive is accessible via REST API. You can build custom integrations, automated reporting, and bulk operations without touching the UI.

Cortex: The Enrichment Engine

Cortex solves the analyst’s most painful problem: you’ve got an IP address or a file hash, and you need to know if it’s dangerous. Right now. Without spending 15 minutes clicking through VirusTotal, AbuseIPDB, Shodan, and a dozen other services.

How Cortex Works in Practice

You’re looking at a case in TheHive. You see an IP address that triggered the alert. You click “Cortex” and select which analyses to run. Cortex takes that IP and simultaneously checks:

VirusTotal — is this IP’s reputation flagged?
AbuseIPDB — how many abuse reports?
Shodan — what services are exposed on this IP?
Your MISP — have we seen this IP before in our threat intelligence?
Talos Intelligence, OTX, Spamhaus — other threat feeds
And 280+ more sources, in parallel

Within seconds, you get back structured results. The intelligence is right there in the case, ready to make a decision.

Cortex can also take action: It integrates with your security tools so it can block IPs on your firewall, add domains to your DNS blocklist, isolate endpoints via CrowdStrike, or create tickets in Jira. Automated containment without human intervention.

Cortex’s Smart Caching

Here’s where Cortex gets clever: it caches results. When you check an IP against VirusTotal, Cortex remembers that result for 10 minutes. If another analyst on your team checks the same IP during that window, they get an instant answer instead of waiting for another API call.

Why does this matter? If you get a phishing email with 15 recipients, and 15 analysts independently start investigating, Cortex doesn’t hammer VirusTotal 15 times. It makes one call, caches the result, and serves it to everyone. You save API quota and stay under rate limits without breaking a sweat.

And if the same malicious IP shows up in three different alerts during the day? First analyst waits 2 seconds for the lookup. The next 14 get instant results.

Shuffle: Orchestration and Automation

Shuffle is the brain of your automation. It decides “when X happens, do Y and then Z.” It ties everything together.

What Makes Up Shuffle

The engine (built in Go) processes workflows at scale, handling thousands of parallel executions without breaking a sweat.

The interface (React-based) lets you drag and drop logic blocks to build automation without writing code. You see the workflow visually, which makes it obvious what’s supposed to happen.

The workers (Orborus) actually execute your workflows, spinning up containers as needed to run analyzers or integrations.

The integrations (800+ pre-built connectors) already know how to talk to Wazuh, Splunk, AWS, CrowdStrike, Slack, PagerDuty, and basically every security tool you already own. You’re not building custom API code.

Trigger Types

# Example: Wazuh → Shuffle webhook trigger
triggers:
  - type: webhook
    name: "Wazuh High-Severity Alert"
    description: "Receives Wazuh alerts with rule.level >= 12"

  - type: schedule
    cron: "0 6 * * 1"
    description: "Monday 6AM: Weekly threat summary digest"

  - type: user_input
    prompt: "Analyst: Should this IP be blocked?"
    description: "Human-in-the-loop approval gate"
    
  - type: api
    endpoint: "/api/v1/execute_workflow"
    description: "Direct programmatic trigger"

The Hybrid Execution Model

Shuffle’s most architecturally significant feature is its hybrid cloud-on-prem execution model. Organizations can route webhook traffic through the Shuffler.io cloud relay directly to their on-premises Shuffle instance. This eliminates the requirement to open inbound ports on the corporate firewall - a significant security win for organizations operating in hardened network environments.

The Economics: Why This Stack Wins

The Cost Reality

Here’s the brutal honesty about commercial SOAR platforms:

Platform	Year 1	Year 3 Total	The Problem
This Open-Source Stack	$0-$12K (infra)	$0-$36K	You need Linux expertise
Palo Alto XSOAR	$80K-$350K	$240K-$1M+	Vendor lock-in, works best with Palo Alto
Splunk SOAR	$60K-$250K	$180K-$750K	Cloud-dependent, steep licensing
IBM QRadar SOAR	$70K-$300K	$210K-$900K	Complex, expensive support
Microsoft Sentinel + Logic Apps	$30K-$150K	$90K-$450K	Azure lock-in

That’s not hyperbole. Three years with Splunk SOAR will cost you three-quarters of a million dollars.

Why It Actually Works Better

No vendor bias. Palo Alto XSOAR works beautifully with Palo Alto firewalls—but integrating Splunk, Wazuh, or CrowdStrike feels clunky. Shuffle doesn’t care. It talks to anything with an API.

Realistic scaling for MSSPs. Managing 100 different client environments in commercial SOAR? You’ll do that with templates and per-client customization work. With Shuffle, you clone a playbook, update a few variables, and you’re done. The tenth client costs a fraction of the first.

Real performance gains. Organizations using this stack have measured a 77% reduction in Mean Time to Respond. That’s not marketing. That’s the result of eliminating manual enrichment work. Your analysts go from spending 6-7 hours a day on triage to spending 1.5 hours. The difference is threat hunting, not paperwork.

Deployment Guide: Production Docker Compose

The fastest path to a functional production environment is Docker Compose. This configuration deploys the full stack on a single server (minimum 16GB RAM, 8 vCPU, 500GB SSD for production).

Prerequisites

# Server requirements: Ubuntu 22.04 LTS
# Docker Engine 24.x + Docker Compose v2

# Increase virtual memory for Elasticsearch
sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf

# Create directory structure
mkdir -p /opt/soc-stack/{thehive,cortex,shuffle,elasticsearch,cassandra,misp}
cd /opt/soc-stack

Docker Compose Configuration

version: "3.8"

services:
  # ─── Cassandra (TheHive Database) ───────────────────────────
  cassandra:
    image: cassandra:4.1
    container_name: cassandra
    hostname: cassandra
    environment:
      - CASSANDRA_CLUSTER_NAME=thp
      - MAX_HEAP_SIZE=1G
      - HEAP_NEWSIZE=200M
    volumes:
      - /opt/soc-stack/cassandra/data:/var/lib/cassandra
    healthcheck:
      test: ["CMD-SHELL", "nodetool status | grep UN"]
      interval: 30s
      timeout: 10s
      retries: 10

  # ─── Elasticsearch (TheHive Index) ──────────────────────────
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.1
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - ES_JAVA_OPTS=-Xms2g -Xmx2g
    volumes:
      - /opt/soc-stack/elasticsearch/data:/usr/share/elasticsearch/data
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:9200/_cluster/health | grep -v red"]
      interval: 30s
      timeout: 10s
      retries: 10

  # ─── TheHive 5 ──────────────────────────────────────────────
  thehive:
    image: strangebee/thehive:5.3
    container_name: thehive
    depends_on:
      cassandra: { condition: service_healthy }
      elasticsearch: { condition: service_healthy }
    ports:
      - "9000:9000"
    volumes:
      - /opt/soc-stack/thehive/config:/etc/thehive
      - /opt/soc-stack/thehive/data:/opt/thp/thehive/files
    command:
      - --storage-provider localfs
      - --cassandra-host cassandra
      - --es-host http://elasticsearch:9200

  # ─── Cortex ─────────────────────────────────────────────────
  cortex:
    image: thehiveproject/cortex:3.1.7
    container_name: cortex
    depends_on:
      elasticsearch: { condition: service_healthy }
    ports:
      - "9001:9001"
    volumes:
      - /opt/soc-stack/cortex/config:/etc/cortex
      - /var/run/docker.sock:/var/run/docker.sock  # Required for analyzer containers
      - /opt/soc-stack/cortex/jobs:/tmp/cortex-jobs
    environment:
      - JOB_DIRECTORY=/tmp/cortex-jobs

  # ─── Shuffle SOAR ───────────────────────────────────────────
  shuffle-backend:
    image: ghcr.io/shuffle/shuffle-backend:latest
    container_name: shuffle-backend
    hostname: shuffle-backend
    ports:
      - "5001:5001"
    volumes:
      - /opt/soc-stack/shuffle:/shuffle-database
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DATASTORE_EMULATOR_HOST=shuffle-database:8000
      - SHUFFLE_APP_HOTLOAD_FOLDER=/shuffle-database/apps
      - SHUFFLE_FILE_LOCATION=/shuffle-database/files
      - SHUFFLE_DEFAULT_USERNAME=admin
      - SHUFFLE_DEFAULT_PASSWORD=changeme_on_first_login

  shuffle-frontend:
    image: ghcr.io/shuffle/shuffle-frontend:latest
    container_name: shuffle-frontend
    ports:
      - "3001:80"
    environment:
      - BACKEND_HOSTNAME=shuffle-backend

  shuffle-orborus:
    image: ghcr.io/shuffle/shuffle-orborus:latest
    container_name: shuffle-orborus
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - BASE_URL=http://shuffle-backend:5001
      - SHUFFLE_APP_SDK_VERSION=1.1.0

Post-Deployment Configuration Steps

# Step 1: Start the stack
docker compose up -d

# Step 2: Monitor startup (takes 3-5 minutes)
docker compose logs -f thehive cortex

# Step 3: Access TheHive at http://YOUR_SERVER:9000
# Default credentials: admin@thehive.local / secret

# Step 4: Access Cortex at http://YOUR_SERVER:9001
# Create a new org and generate an API key

# Step 5: Link Cortex to TheHive
# TheHive Admin → Platform Management → Cortex
# Paste the Cortex API key and server URL

# Step 6: Access Shuffle at http://YOUR_SERVER:3001
# Complete onboarding wizard

Integration Blueprint: Wazuh → Shuffle → TheHive

This is the most common production integration pattern. Here is the complete data flow and configuration.

Step 1: Configure Wazuh to Forward Alerts to Shuffle

Add the following integration block to /var/ossec/etc/ossec.conf on your Wazuh Manager:

<integration>
  <name>custom-shuffle</name>
  <hook_url>http://YOUR_SHUFFLE_SERVER:5001/api/v1/hooks/webhook_XXXXXXXX</hook_url>
  <level>12</level>  <!-- Only forward critical/high severity -->
  <alert_format>json</alert_format>
</integration>

Restart the Wazuh Manager after the configuration change:

sudo systemctl restart wazuh-manager

Step 2: Build the Shuffle Phishing Triage Playbook

[Webhook: Wazuh Alert Received]
         │
         ▼
[Condition: rule.groups contains "syscheck" or "web"]
         │
    ─────┴─────
    │          │
   YES         NO → [Skip/Log]
    │
    ▼
[Regex: Extract observables]
 • src_ip from data.srcip
 • file_hash from syscheck.sha256_after
 • domain from data.url
         │
         ▼
[Cortex: Analyze src_ip with AbuseIPDB]
[Cortex: Analyze file_hash with VirusTotal]
         │
         ▼
[Condition: vtScore > 5 OR abuseConfidence > 75]
         │
    ─────┴─────
    │          │
   YES         NO → [Close: Low Priority]
    │
    ▼
[TheHive: Create Alert]
 • title: "Wazuh - [rule.description]"
 • severity: Critical
 • observables: [ip, hash, Cortex results]
 • tags: ["automated", "wazuh", rule.groups]
         │
         ▼
[Slack/Teams: Notify SOC Channel]
 • "New critical alert created in TheHive"
 • Link to case

Step 3: TheHive Alert Template for Wazuh

Create an Alert Response Template in TheHive for automated case creation from triaged alerts:

{
  "title": "Wazuh SIEM - {{alert.title}}",
  "description": "## Automated Alert\n\n**Source:** Wazuh SIEM\n**Rule:** {{alert.sourceRef}}\n**Host:** {{alert.source}}\n\n## Observables\n\n{{#observables}}\n- {{dataType}}: `{{data}}`\n{{/observables}}",
  "tasks": [
    { "title": "Verify alert is not a false positive", "assignee": null },
    { "title": "Enrich all observables with Cortex analyzers", "assignee": null },
    { "title": "Determine scope - check for lateral movement", "assignee": null },
    { "title": "Execute containment if confirmed malicious", "assignee": null },
    { "title": "Document findings and close case", "assignee": null }
  ],
  "tags": ["wazuh", "automated-triage"]
}

Real-World Case Study: Phishing Campaign Triage at Scale

The Scenario

A regional financial services firm (1,200 employees, 3-person security team) was receiving 400-600 security alerts per day from Wazuh. The team was spending 6-7 hours daily on manual triage, leaving little capacity for proactive threat hunting or incident response.

The Problem (Before)

Metric	Before Deployment
Daily alert volume	450 average
Manual triage time per alert	8-12 minutes
True positive rate (pre-enrichment)	~12%
MTTR (confirmed incidents)	4.2 hours
Analyst hours on L1 triage	6.5 hours/day
Incidents missed (per quarter)	3-4 (analyst fatigue)

The Solution Architecture

The team deployed:

TheHive 5 Community on a dedicated Ubuntu 22.04 VM (8 vCPU, 32GB RAM)
Cortex 3.1 with 12 configured analyzers (VirusTotal, AbuseIPDB, MISP, Shodan, URLhaus, MalwareBazaar, Hybrid Analysis, PassiveTotal, Talos Intelligence, OTX, Spamhaus, Greynoise)
Shuffle with two primary playbooks: Phishing Email Triage and Malware Alert Enrichment
Integration: Wazuh Manager forwarding rules 85, 91xxx (phishing detection), and rule level ≥12 to Shuffle webhook

The Phishing-Specific Playbook

Wazuh fires on email gateway rule (rule group: office365 or exchange)
Shuffle extracts: sender domain, sender IP, attachment hash, embedded URLs
Cortex triggered in parallel:
- AbuseIPDB on sender IP (confidence threshold: 50%)
- VirusTotal on attachment hash (detection threshold: 3/72)
- URLhaus on embedded URLs
- SpamHaus on sender domain
Shuffle evaluates results - if any threshold exceeded, severity escalated to Critical
TheHive case created with pre-populated observables, all Cortex results attached
Slack message sent to #soc-alerts with case link and summary
If hash detected by VirusTotal with 20+ detections, Shuffle triggers CrowdStrike Falcon API to initiate custom IOC block across all endpoints

The Results (After 90 Days)

Metric	Before	After	Change
Daily alert volume	450	450	-
Automated triage rate	0%	78%	+78%
True positive escalation rate	12%	91%	+79%
MTTR (confirmed incidents)	4.2 hours	58 minutes	-77%
Analyst hours on L1 triage	6.5 hours/day	1.4 hours/day	-78%
Incidents missed (per quarter)	3-4	0	-100%

Those 5.1 hours of daily analyst time recovered translated directly into a meaningful investment in proactive threat hunting, detection rule tuning, and vulnerability management - the high-value work that prevents incidents from happening in the first place.

Is This the Right Stack for You?

Perfect Fit

MSSPs managing multiple clients — Multi-tenancy plus reusable playbooks mean you can onboard new customers without reinventing the wheel every time. The economics are unbeatable.

Mid-market enterprises growing fast — You need enterprise-grade SOAR capabilities, but you’re not going to drop $200K-$300K per year on licensing when you could spend a fraction of that on infrastructure and engineering.

Highly regulated industries (healthcare, finance, government) — Your data never leaves your network. No vendor telemetry, no cloud dependency. Complete control over your most sensitive incident data.

Teams with strong Linux/DevOps skills — You have the expertise to operate this. You understand Docker, can troubleshoot cluster issues, and have time to tune detection rules. This stack rewards deep technical knowledge.

Lean security teams — You’ve got 2-8 analysts doing the work of 5-10. Automation isn’t a luxury—it’s how you survive. This stack is designed for teams like yours.

When to Look Elsewhere

Zero Linux expertise in-house — If your team barely knows Docker and you can’t hire or train DevOps skills, this is too much operational burden. Look at Splunk SOAR or Microsoft Sentinel.

You need a vendor SLA — If something breaks at 2 AM and you need guaranteed support, you’ll want a commercial platform with a support contract.

All-Microsoft environment — If your entire stack is Azure, Teams, and Microsoft 365, Sentinel + Logic Apps will integrate more naturally than this stack.

You want instant playbooks, not to build them — Palo Alto XSOAR ships with hundreds of pre-built playbooks. This stack requires you to build your own.

Security Hardening: Production Best Practices

Deploying these platforms securely requires specific hardening beyond default configurations.

Docker Security

# Run containers as non-root where possible
# Cortex requires Docker socket access - harden with socket proxy

# Deploy docker-socket-proxy instead of exposing raw socket to Cortex/Shuffle
docker run -d \
  --name dockerproxy \
  -e CONTAINERS=1 \
  -e IMAGES=1 \
  -e INFO=1 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -p 127.0.0.1:2375:2375 \
  tecnativa/docker-socket-proxy

Network Segmentation

[Internet]
    │
[Wazuh Manager] ─── webhook ──► [Shuffle] (VLAN: Automation)
                                     │
                        ┌────────────┼────────────┐
                        ▼            ▼             ▼
                   [TheHive]    [Cortex]     [MISP]
                  (VLAN: SOC)  (VLAN: SOC) (VLAN: SOC)
                      │            │
                      └────────────┘
                           │
                   [Elasticsearch + Cassandra]
                   (VLAN: Data, no internet access)

API Key Rotation Policy

# TheHive API key rotation (run quarterly via cron)
# Generate new API key via TheHive API
NEW_KEY=$(curl -s -X POST http://localhost:9000/api/v1/user/current/credentials \
  -H "Authorization: Bearer $CURRENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "key"}' | jq -r '.key')

# Update Shuffle with new TheHive API key
curl -X PUT http://localhost:5001/api/v1/apps/authentication \
  -H "Authorization: Bearer $SHUFFLE_ADMIN_KEY" \
  -d "{\"thehive_api_key\": \"$NEW_KEY\"}"

Cortex Analyzers: Recommended Starter Configuration

For a new deployment, prioritize configuring these analyzers in sequence. Each requires an API key from the respective platform - most offer free tiers sufficient for small SOC volumes.

Priority	Analyzer	Data Types	Free Tier
🔴 Critical	VirusTotal	Hash, IP, Domain, URL	500 req/day
🔴 Critical	AbuseIPDB	IP	1,000 req/day
🔴 Critical	MISP	All	Self-hosted, unlimited
🟠 High	Shodan	IP	100 req/month
🟠 High	URLhaus	URL, Domain	Free
🟠 High	MalwareBazaar	Hash	Free
🟠 High	OTX (AlienVault)	Hash, IP, Domain, URL	Free
🟡 Medium	Hybrid Analysis	Hash, URL	200 req/day
🟡 Medium	PassiveTotal	IP, Domain	15 req/day
🟡 Medium	Talos Intelligence	IP, Domain	Free (web)
🟢 Optional	Spamhaus	IP, Domain	Free
🟢 Optional	Greynoise	IP	100 req/day (free)

The Real Verdict

I’ve deployed six-figure commercial SOAR platforms, and I’ve built this open-source stack on a $150-per-month cloud server. The analyst experience? Nearly identical. The cost difference? $80,000 to $300,000 per year.

Here’s what you’re actually buying from commercial vendors: convenience. Managed infrastructure. Vendor support at 2 AM. Pre-built playbooks you didn’t have to write.

If your team has the Linux and Docker skills to operate this stack—and yes, that’s the key assumption—the ROI is trivial to calculate.

That 77% MTTR improvement you read about earlier? That’s real. It’s not marketing. It comes directly from replacing manual IOC lookups with machine-speed automation. That time saved translates into actual threat hunting. Actual proactive defense. The work that prevents incidents instead of just responding to them.

The blueprint is open. The code is free. Your security team’s time is expensive. The math is straightforward.

Additional Resources

Resource	Description
TheHive 5 Documentation	Official deployment and API guides
Cortex Documentation	Analyzer/Responder catalog and configuration
Shuffle Documentation	Playbook building and app integration guides
Cortex-Analyzers GitHub	300+ open-source analyzer scripts
MISP Integration Guide	Threat intelligence platform integration
Docker-Templates (StrangeBee)	Official TheHive + Cortex + Shuffle Compose templates
SOC Automation Lab (uruc)	Community-built end-to-end homelab guides