Shuffle

Jutsu integrates with Shuffle for SOAR workflow orchestration, so you can run your existing Shuffle playbooks as part of your response process. Jutsu talks to your Shuffle instance over its remote API and executes workflows on demand.

Overview

Shuffle is an open-source SOAR platform where you build automation workflows. When you set your response provider to Shuffle, Jutsu connects to your Shuffle deployment, lists the workflows defined there, and lets you run them against an incident—without rebuilding that automation inside Jutsu.

Jutsu supports two response providers: the built-in AgentSOAR and Shuffle. Choose Shuffle when you already run playbooks there and want Jutsu to trigger them.

What this enables

  • Reuse your playbooks — run the Shuffle workflows your team has already built.
  • Run from an incident — trigger a workflow as a response step and pass execution arguments to it.
  • Track executions — see the executions Jutsu has started for a workflow, with their status and timestamps.

Connect Shuffle

To connect, set your response provider to Shuffle and provide your Shuffle connection details:

  • Base URL — the address of your Shuffle instance (for example, your self-hosted host or the Shuffle cloud endpoint).
  • API key — a Shuffle API key with permission to list and execute workflows. Jutsu sends it as a bearer token on each request.

Jutsu verifies the connection by listing the workflows on your instance. If the credentials or base URL are wrong, the test fails and no workflows appear.

Exact field labels, the base URL format, and where to generate the API key depend on your Shuffle version and your Jutsu deployment. Confirm against your deployment.

Run a playbook

Once connected, Jutsu pulls the list of workflows from your Shuffle instance. Pick the workflow you want and run it as a response action. Jutsu starts the execution through Shuffle's API and can pass an execution argument so the workflow receives context about the incident.

Each run returns an execution that Jutsu tracks, so you can follow its status back in the incident. To pull in new or renamed workflows after you change them in Shuffle, re-sync the workflow list.

Troubleshooting

  • No workflows listed — confirm the base URL points at your Shuffle instance and the API key is valid. Jutsu lists workflows to validate the connection, so an empty or failed list usually means a connection problem.
  • Execution fails — verify the workflow is valid and enabled in Shuffle, and that the API key's account is allowed to execute it.
  • Stale workflow list — if a workflow you just created in Shuffle is missing, re-sync the playbooks to refresh Jutsu's copy.