Building a SOAR Platform with Shuffle in Your Homelab

This guide explains how to deploy and configure the open-source Shuffle SOAR platform using Docker Compose, integrate it with Wazuh for alert ingestion, add VirusTotal enrichment and notification workflows (Slack/Email), and optionally front the service with Nginx. It includes architecture details, required environment variables, step-by-step setup (host prep, .env and compose review, starting the stack, creating webhook-triggered workflows), testing checks, common troubleshooting tips, and recommended next steps such as TheHive/MISP integration and backup strategies.