Shuffle SOAR Platform

{
  "name": "IOC Enrichment Workflow",
  "description": "Automated IOC enrichment with multi-source intelligence",
  "start": "webhook",
  "triggers": [
    {
      "name": "Webhook Trigger",
      "app": "webhook",
      "function": "webhook_trigger",
      "parameters": {
        "url": "/api/v1/hooks/ioc-enrichment"
      }
    }
  ],
  "actions": [
    {
      "name": "Parse IOC",
      "app": "shuffle_tools",
      "function": "parse_ioc",
      "input": "$exec.webhook_trigger.body"
    },
    {
      "name": "VirusTotal Lookup",
      "app": "virustotal",
      "function": "get_report",
      "input": "$exec.parse_ioc.ioc_value",
      "authentication": "virustotal_api_key"
    },
    {
      "name": "MISP Search",
      "app": "misp",
      "function": "search_attributes",
      "input": {
        "value": "$exec.parse_ioc.ioc_value",
        "type": "$exec.parse_ioc.ioc_type"
      }
    },
    {
      "name": "AbuseIPDB Check",
      "app": "abuseipdb",
      "function": "check_ip",
      "input": "$exec.parse_ioc.ioc_value",
      "conditions": [
        {
          "field": "$exec.parse_ioc.ioc_type",
          "operator": "equals",
          "value": "ip"
        }
      ]
    },
    {
      "name": "Aggregate Results",
      "app": "shuffle_tools",
      "function": "merge_reports",
      "input": [
        "$exec.virustotal_lookup.result",
        "$exec.misp_search.attributes",
        "$exec.abuseipdb_check.data"
      ]
    },
    {
      "name": "Calculate Threat Score",
      "app": "shuffle_tools",
      "function": "calculate_score",
      "input": "$exec.aggregate_results.merged_data"
    },
    {
      "name": "Create TheHive Alert",
      "app": "thehive",
      "function": "create_alert",
      "input": {
        "title": "IOC Enrichment: $exec.parse_ioc.ioc_value",
        "description": "$exec.aggregate_results.summary",
        "severity": "$exec.calculate_score.severity",
        "tags": ["shuffle", "automated", "ioc-enrichment"],
        "artifacts": "$exec.aggregate_results.artifacts"
      }
    },
    {
      "name": "Notify Team",
      "app": "slack",
      "function": "send_message",
      "input": {
        "channel": "#threat-intel",
        "text": "🚨 New IOC Alert",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*IOC:* `$exec.parse_ioc.ioc_value`\n*Score:* $exec.calculate_score.score/100"
            }
          }
        ]
      }
    }
  ],
  "branches": [
    {
      "name": "High Severity Branch",
      "condition": "$exec.calculate_score.score > 75",
      "actions": ["create_thehive_alert", "notify_team"]
    },
    {
      "name": "Low Severity Branch",
      "condition": "$exec.calculate_score.score <= 75",
      "actions": ["log_to_database"]
    }
  ]
}