CyberBlueSOC

0 tools selected

Agent Deployment Center

Deploy pre-configured security agents to your endpoints. Download complete packages with binaries and configurations.

Velociraptor

Digital forensics and incident response platform

Windows Linux macOS

Click to configure & download

Wazuh

Ready

Host-based intrusion detection system

Windows Ubuntu/Debian RHEL/CentOS

Click to configure & download

Shuffle Automations

Ready

Integration guide & workflow templates

14 Tool Integrations Workflow Templates

Click for integration guide

Arkime PCAP

Ready

Live network traffic capture

1-60 min capture Download PCAP

Click to start capture

Caldera Sandcat

Red Team

Adversary emulation & attack simulation

Windows Linux macOS

Authorized Use Only!

Click for deployment

Shuffle SOAR Integration Guide

All CyberBlue tools are pre-configured and ready to integrate with Shuffle workflows. Use the connection details below to automate your SOC operations.

Quick Start

Access Shuffle: https://YOUR_IP:7002
Login (create admin account on first use)
Create new workflow or import template
Use tool URLs below for integrations
Test your automation!

Common Use Cases

Wazuh Alert → MISP Enrichment → TheHive Case
File Hash → VirusTotal → Velociraptor Hunt
Scheduled Threat Hunting with Velociraptor
Automated IOC submission to MISP
Incident response playbook automation

Network Traffic Capture

Capture Duration

Pro Tip: You can also capture from command line:
bash generate-pcap-for-arkime.sh --live-5min

Agent Configuration

1 Enter Your Server IP Address

This is the public or internal IP of your CyberBlueSOC server

2 Select Operating System

3 Download Complete Package

Important: Make sure the required port is accessible from your endpoints. Extract the ZIP package and follow instructions included in the package.

Threat Intelligence Hub

Search IOCs, view threat feeds, and access intelligence from MISP

IOC Search

MISP Statistics

--

Events

--

Attributes

--

Active Feeds

Threat Feeds

Last sync: --

Pro Tip: Configure feeds manually:
bash misp/configure-threat-feeds.sh

Recent Threat Events

Loading recent events...

YARA Malware Detection

Pattern-based threat hunting

--

Total Rules

--

Version

Last Update:

Categories:

Sigma Detection Rules

Universal SIEM signatures

--

Total Rules

--

Version

Last Update:

Categories:

CPU Usage

Memory Usage

Disk Usage

Network I/O

Container Status Overview

0 0 0

Loading container status...

Security Categories

Loading categories...

Recent Security Events

Loading events...

Network Statistics

Loading network stats...

CyberBlueSOC

System Status

💡 Smart Suggestions

No tools found

Agent Deployment Center

Velociraptor

Wazuh

Shuffle Automations

Arkime PCAP

Caldera Sandcat

Shuffle SOAR Integration Guide

Quick Start

Common Use Cases

Network Traffic Capture

Capture Duration

Agent Configuration

1 Enter Your Server IP Address

2 Select Operating System

3 Download Complete Package

Package Contents:

Threat Intelligence Hub

IOC Search

MISP Statistics

--

--

--

Threat Feeds

Recent Threat Events

YARA Malware Detection

--

--

Sigma Detection Rules

--

--

Container Status Overview

Security Categories

Recent Security Events

Network Statistics

CyberBlueSOC

System Status

💡 Smart Suggestions

No tools found

Agent Deployment Center

Velociraptor

Wazuh

Shuffle Automations

Arkime PCAP

Caldera Sandcat

Shuffle SOAR Integration Guide

Quick Start

Common Use Cases

Network Traffic Capture

Capture Duration

Agent Configuration

1 Enter Your Server IP Address

2 Select Operating System

3 Download Complete Package

Package Contents:

Threat Intelligence Hub

IOC Search

MISP Statistics

--

--

--

Threat Feeds

Recent Threat Events

YARA Malware Detection

--

--

Sigma Detection Rules

--

--

Container Status Overview

Security Categories

Recent Security Events

Network Statistics

Tool Credentials

Tool Information