Shuffle

In obserae: create a Webhook output with a signing secret for the alerts. The Shuffle app covers the inbound half — a workflow asking obserae questions.

There is no app definition to download, and that is the design. Shuffle’s App Creator builds an app from an OpenAPI document, so the obserae app is openapi-soar.yaml — the fourteen operations of the SOAR profile, each with a typed response schema and a response example, which is what Shuffle shows you while you build a field mapping.

Hand-editing an exported app definition would create a second copy of the contract that nobody regenerates. If an operation imports badly, the defect is in the specification, and fixing it there reaches every connector at once.

Import it

1. In obserae, mint a token: Identity & Access → Users → + New token, on a user whose group holds sessions:read, alerts:read, alerts:ack, cartography:read and rules:read. Do not give it indicators:read — that belongs on the firewall’s own credential, not on your automation’s. See a token for a playbook.
2. Download the profile from your own instance: GET /api/openapi-soar.yaml. Taking it from the running daemon guarantees it describes the operations that daemon serves.
3. In Shuffle, Apps → Create app → From OpenAPI, and give it the file.
4. Set authentication to a Bearer token and paste the one you minted.

The check that the import worked: build a two-node workflow with lookupEnrichment first, and in the second node’s field picker expand the first node’s output. items.0.asn, items.0.country and items.0.threat_intel.0.source must be selectable from the list, with no JSON path typed by hand. That is the whole point of the typed profile; if they are not there, the import lost the response schemas.

Alerts into Shuffle

A Webhook output pointed at a Shuffle webhook trigger, with a signing secret. Verify X-Obserae-Signature before anything else — see Verifying the signature — and deduplicate on X-Obserae-Delivery.