Lion Cipher Lab
Automate alert triage with a SOAR playbook (Shuffle)
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A SOC drowns in alerts, and most of them get the same treatment: look up the IP's reputation, check the file hash, see who the user is, decide malicious or benign, and tell someone. Doing that by hand hundreds of times a day is where analysts burn out and where slow, inconsistent responses come from. SOAR — Security Orchestration, Automation and Response — turns that repeatable runbook into a workflow the computer runs in seconds, so people spend their attention on the judgment calls a machine cannot make. Learning to build one (not just click through a vendor demo) is one of the most…
What you'll learn
- SOAR concepts (orchestration, automation, response)
- Self-hosting Shuffle with Docker Compose
- Building an automation workflow (Apps, Actions, Triggers)
- Enriching an indicator and branching on a Condition
- Reading execution results node by node
- Deciding when to automate triage vs gate a response
Steps in this lab
- What SOAR is, and where it sits
- Meet Shuffle — the tool we'll use
- Stand Shuffle up with Docker
- First-run: create your admin account
- The vocabulary: Apps, Actions, Triggers, Conditions
- Build the workflow: trigger → enrich → branch → verdict
- Run it and read the execution results
- Doing it right: automate triage, gate the response