1. Shuffle Deployment

We deployed Shuffle as a cluster setup with EFS (Elastic File System) to ensure data persistence and Multi-AZ availability, allowing high reliability for our SOC. This setup provides continuous operation even in the event of an AZ failure, ensuring that our automated workflows are always available.

2. Incident Response Workflow

This workflow is designed to automate the response to alerts generated by Wazuh either by creating cases or triggering incident response automation workflows.

The process is as follows:

Triggering the Workflow:The workflow is triggered via a webhook when a Wazuh alert is received. Depending on the rule_id in the alert, the workflow determines the next steps.

Branch Condition Based on Known rule_id:

If the rule_id is in the known list, indicating predefined rules for automated responses:

• The event is saved in a file and uploaded to an S3 bucket
• The S3 bucket has a Lambda event trigger for object creation, which parses the rule_id from the payload and triggers the respective Lambda function to handle the incident response

Upon completion, the status is published via SNS to notify the appropriate team

If the rule_id is not in the known list:

• We retrieve the severity, title, and description based on alert metadata.

Rule-level mapping:

• Wazuh’s rule_level (ranging from 1-15) is mapped to TheHive severity (1-4) using a Python script, with the following mapping:
• Rule level 1-4 → Low severity
• Rule level 5-9 → Medium severity
• Rule level 10-12 → High severity
• Rule level >12 → Critical severity

• Based on the alert location (e.g., wazuh-aws, rootcheck, wazuh-monitord), an appropriate owner is assigned to the case.
• If the alert contains observables with a source_ip_address, the case is updated with the IP as an Indicator of Compromise (IOC).
• The case is then exported to MISP via a Python script for threat intelligence correlation.

3. Case Management Notification workflow:

This workflow handles notifications for case creation and closure events in TheHive, ensuring real-time communication with the SOC team.

Here’s how it operates:

• Triggering the Workflow: The workflow is triggered when TheHive sends case creation or closure events to the Shuffle webhook.
• Event Handling:

The event data is copied to a file and uploaded to an S3 bucket.

The S3 bucket has a Lambda function triggered by object creation events. The function parses the event and generates the appropriate message.

The message is then published to Slack or Email via SNS, notifying the SOC team of case changes in real-time.