OpenSOAR vs Shuffle
OpenSOAR
opensoar.appShuffle
shuffler.ioSide by side
| Figure | OpenSOAR | Shuffle |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 3 |
| Spec score · Security Orchestration, Automation, and Response Software | 8.5 (#1) | 7.6 (#6) |
| API | The service exposes a FastAPI API covering alerts, playbooks, runs, integrations, incidents, authentication and webhooks. | Shuffle describes itself as API-first and documents Bearer-token authentication for its API on both cloud and on-prem installations. |
| Authentication | Authentication uses JWT sessions and API keys, with role-based authorization described in the architecture documentation. | Shuffle documents tenant-controlled SAML/SSO and MFA, and names Okta, Auth0, PingID, and AzureAD as supported platforms. |
| Integrations | The maker lists Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email as integrations, with an extensible Python SDK. | Shuffle's public app catalog lists more than 2,500 apps, including integrations such as Slack, Gmail, MISP, Wazuh, Splunk, and Jira. |
| Purpose | OpenSOAR is an open-source platform for automating alert triage, enrichment, and response using Python playbooks. | Shuffle is an open-source automation platform designed for the security industry, for building and executing automation workflows. |
Plans
In their own words
OpenSOAR
OpenSOAR is an open-source platform for automating security alert handling with Python playbooks. It accepts alerts through webhooks, Elasticsearch polling, and syslog, then can normalize their data, extract indicators of compromise, and remove duplicates. Playbooks are asynchronous Python functions that teams can test, version, and run with standard Python packages. The execution engine supports parallel actions, timeouts, retries, and exponential backoff. For incident work, OpenSOAR can create and link cases, assign them, add comments and observables to timelines, and surface correlation suggestions. Listed integrations include Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email; a Python SDK can be extended. AI options include Claude, OpenAI, and Ollama for tasks such as summarization, triage recommendations, playbook generation, and correlation. The maker says local Ollama can keep AI triage data within the network. OpenSOAR is self-hosted, with Docker Compose deployment documented, and is available on the web and through an API. The free plan is free, with no feature gates or per-action billing. The homepage labels the product beta.
Shuffle
Shuffle is an open-source automation platform for security teams to build and run workflows. Its visual designer works with a no-code app creator that can generate integrations from Swagger or OpenAPI specifications and API documentation URLs. The public catalog contains more than 2,500 apps, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. Workflows can start through webhooks, schedules, subflows, or user input; extension triggers include AWS Lambda, AWS S3, Kafka, and Pub/Sub.
Deployment choices include self-hosted open source, self-hosted licensed software, Shuffle Cloud, and hybrid setups. Documented runtime architectures include Docker Compose, Docker Swarm, a cloud-hybrid local Orborus runner, and Kubernetes with Helm charts. Shuffle documents bcrypt password hashing, AES-256 encryption, tenant-controlled SAML/SSO and MFA, and a Bearer-token API. The free Scale plan is free and includes 2,000 app runs per month, with a hard limit, three tenants, and one location. Custom Python apps are not yet easy to create for Shuffle Cloud, though on-premises instances support local app hotloading.