SOAR features to Security onion

[krshnn]

I was recently searching to automate some things and came across https://shuffler.io/ which can be utilized to be a SOAR.
Thinking about using this tool to forward alerts to ITSM and for other possible tasks to external sources (Like blocking IP address and such) from Security Onion. Thoughts?

[weslambert]

I wrote about something like this a while back and actually have a blog post in progress that includes the use of Shuffle if you are interested.

https://github.com/weslambert/DinoSOARLab

[krshnn]

thank you for sharing!

[Crimson1110]

Hello,

I was able to integrate N8N thanks to your blog. It basically passes the observables to N8N, then are inserted to a DNSBL list or directly to the firewall rules. I was wondering if it is possible to automate this process ? Lets say if there is a critical alert, it creates a case automatically so that the IP's will be added to observables. Thank you in advance.