Help Center← Back to Dashboard
Getting Started
What is Aithroyz?Quickstart: First EnvironmentCloud CredentialsPlans & Approvals
Environments
OverviewLifecycle PhasesTTL Auto-DestroyExtending TTLDestroying an Environment
Tools Reference
OverviewElastic Stack (SIEM)Wazuh (XDR)MITRE CalderaTheHive & DFIR-IRISVelociraptorOpenCTIGrafana + PrometheusShuffle SOARn8nUptime KumaLLM GatewayOpen WebUIFlowiseOpenClawOllamaQdrantLangfusePortainerGiteaSonarQubeCode ServerMattermostMinIOMetabaseHashiCorp VaultKeycloak SSONetBoxLocalStack
Access & Security
Google SSOTenant IsolationPasskeys & MFATeam Members
API & Integrations
API KeysMCP Tools (Clevername)Terraform ExportWebhooks & Callbacks
Stack Presets
SOC PlatformIR / DFIR LabThreat HuntingQuick Sandbox
Settings
Cloud KeysAPI KeysBillingAudit Log
Troubleshooting
Common IssuesDeployment FailuresDNS & ConnectivityTool Health Checks
Aithroyz Help
Help CenterTools ReferenceShuffle SOAR & n8n

Shuffle SOAR & n8n

Shuffle SOAR provides drag-and-drop security orchestration and automated response playbooks. n8n is a general-purpose workflow automation tool for connecting tools and external APIs.

Both Shuffle and n8n can be deployed in the same environment. Shuffle focuses on security-specific playbooks with pre-built integrations for Elastic, TheHive, Wazuh, and OpenCTI. n8n is more general-purpose and integrates with hundreds of external services.

Shuffle SOAR — Access

URL: https://shuffle.<env-name>.ops.aithroyz.com

Shuffle comes with pre-built workflow templates for common SOC use cases: alert triage from Elastic, case creation in TheHive, enrichment with OpenCTI, and notifications via Slack/email. Start from a template and customize the playbook for your environment.

n8n — Access

URL: https://n8n.<env-name>.ops.aithroyz.com

n8n is pre-seeded with demo workflows showing how to connect Elastic alerts to TheHive case creation. The n8n webhook URL can receive alerts from any tool in the environment via HTTP POST.

ℹ
n8n workflows can call the Aithroyz API to provision or destroy environments programmatically — enabling automated lab lifecycle management from within your SOC.
Related Articles
Elastic Stack (SIEM)Read article →TheHive & DFIR-IRISRead article →SOC Platform PresetRead article →