Skip to main content

SOC Command Center (TheHive, Cortex, MISP & Shuffle SOAR)

VulnerGuard bridges the gap between offensive penetration testing and defensive incident response by embedding a complete, isolated Security Operations Center (SOC) stack on a dedicated defensive network plane and exposing it through a unified, RBAC-protected SOC Broker (/api/soc/*) in the SOC Console (/soc).

1. Integrated SOC Appliance Stack​

All four defensive appliances run inside isolated containers on the private SOC network plane and communicate exclusively with the authenticated VulnerGuard SOC Broker:

ApplianceLogical Service RoleBroker Endpoint PrefixPrimary Defensive Role
TheHivevg-soc-thehive/api/soc/thehive/*Security Incident & Case Management, Alert Triage, Task Assignment, and Observable Tracking.
Cortexvg-soc-cortex/api/soc/cortex/*Observable Enrichment & Active Response Engine (DNS, Whois, VirusTotal, AbuseIPDB, Shodan analyzers).
MISPvg-soc-misp/api/soc/misp/*Malware Information Sharing Platform & Threat Intelligence IOC Correlation (IPs, Domains, SHA256 hashes).
Shuffle SOARvg-soc-shuffle/api/soc/shuffle/*Low-Code Security Orchestration, Automation, and Response Workflow Engine.

2. How the Zero-Trust SOC Broker Works​

Instead of exposing TheHive, Cortex, MISP, or Shuffle directly to the public internet, VulnerGuard implements a zero-trust SOC Broker:

  1. Single Sign-On Experience: Operators authenticate once to VulnerGuard with their JWT session and navigate to https://vulnerguard.com/soc.
  2. Server-Side Credential Injection: The backend injects encrypted API credentials (THEHIVE_API_KEY, CORTEX_API_KEY, MISP_API_KEY, SHUFFLE_API_KEY) stored in the Admin Vault (AppSetting) when proxying requests across the private SOC plane.
  3. Unified Telemetry Aggregation (GET /api/soc/overview): Fetches real-time health, open alerts, active cases, analyzer statuses, and recent threat events across all four appliances in a single request.

3. Core SOC Workflows​

Workflow A: Promoting Scan Findings to TheHive Alerts & Cases​

When a VulnerGuard scan uncovers a critical or high-severity vulnerability:

  1. Open the SOC Console (/soc) or click Escalate to TheHive from the scan findings view.
  2. VulnerGuard invokes POST /api/soc/thehive/alert or POST /api/soc/thehive/case with the target hostname, severity, CVSS score, and raw tool evidence attached as observables.
  3. SOC analysts can track remediation tasks, assign responders, and close the case directly from the SOC Console.

Workflow B: Running Cortex Observable Analyzers​

Need to pivot on a suspicious IP address, domain, or file hash discovered during reconnaissance?

  1. In the SOC Console → Cortex Analyzers panel, select an active analyzer (GET /api/soc/cortex/analyzers).
  2. Submit the observable data and dataType (ip, domain, url, hash, mail) to POST /api/soc/cortex/run.
  3. Cortex executes the analyzer job in isolation and returns structured enrichment telemetry back to the console.

Workflow C: Querying MISP Threat Intelligence Events​

  1. Open the MISP Threat Intel tab in /soc (GET /api/soc/misp/events).
  2. Correlate discovered subdomains, SSL certificate fingerprints, or external script hosts against known adversary infrastructure and IOC feeds.

Workflow D: Triggering Automated Shuffle SOAR Playbooks​

  1. Configure a webhook or workflow inside Shuffle SOAR.
  2. Trigger automated containment actions (such as WAF IP blocking, ticket creation, or security channel paging) directly from VulnerGuard via POST /api/soc/shuffle/webhook.