Summary
In this chapter, we learned about the purpose of SOAR and how an SOC analyst uses SOAR in a real-world environment. We also learned how to set up a Shuffle SOAR platform using a Docker Compose environment and fixed some backend related issues. This chapter continued with the integration of Wazuh with Shuffle to receive alerts from Wazuh in real time. Finally, we learned how to remotely manage Wazuh using API integration and also covered some popular third-party integrations with Shuffle.
In the next chapter, we will learn about Wazuh’s active response module to build a proactive incident response system. We will also cover some practical incident response use cases.
