It was 2 AM when the alerts started coming in.
First one, flagging an unusual login attempt on a server. Then a second. A third. Within minutes, a dozen notifications were stacking up across different systems: a batch in the SIEM, the EDR screaming about a suspicious process, the email gateway tagging a handful of phishing candidates. The on-call security engineer had to figure out whether these were different angles of the same attack or just unrelated noise.
The manual process was all too familiar. Open the SIEM console, look up the IP, correlate logs by hand. Switch to the EDR, trace the process tree. Jump to the email system, verify recipients. Every step meant logging into a different tool, copying and pasting, cycling through browser tabs. If this turned out to be a real attack, forty minutes could pass before the full picture emerged, and by then the attacker might have already moved laterally through the network.
This frustration is not unique to any one team. Many small and mid-sized security teams operate this way: stitching together data from different systems by hand, triaging alerts based on experience, and maintaining response procedures through tribal knowledge. It works well enough when alert volumes are low. When the threat surface expands and volume doubles, human bandwidth becomes the bottleneck.
That is exactly the problem SOAR (Security Orchestration, Automation, and Response) platforms are designed to solve.
Tracecat: The New Generation of Open Source SOAR
Tracecat is one of the more interesting projects to emerge in the open source SOAR space over the past couple of years. Its GitHub repository started gaining traction in the security community around 2024, and by 2026 it had accumulated close to four thousand stars. For a tool this specialized, that number is not small.
Its design philosophy is straightforward. Incident response workflows are described as playbooks, where each playbook is a sequence of action nodes that pass context to one another. Engineers write the playbook once, and the platform handles execution whenever an alert triggers it, logging inputs and outputs at every step for later review.
Tracecat is built in Python, which is an advantage in security circles where Python is the de facto scripting language. Writing custom integrations requires minimal overhead. Triggers support webhooks, scheduled tasks, and connections to common SIEM tools. Case management is also maturing: multiple related alerts can be grouped under a single incident, giving responders a unified view instead of isolated notifications.
For small and mid-sized security teams that need real automation capability without a large budget, Tracecat is worth a serious evaluation.
—
Tines: The Commercial SOAR with a Different Philosophy
If Tracecat represents the open source, self-hosted, engineer-first approach, Tines takes a different path entirely.
Tines is a commercial SOAR platform from an Irish company, and its defining feature is no-code workflow building. Automation is assembled through a drag-and-drop interface without writing any code. This design has made Tines popular with larger enterprise security teams where not every person involved in response workflows has an engineering background.
Tines offers a free community tier with limited capabilities. Full enterprise features require a paid plan, with pricing that scales by team size and usage. For organizations with the budget, Tines’ low barrier to entry and mature integration library are real advantages. For teams that need full data sovereignty or cannot depend on a third-party SaaS, it is less suitable.
The Tines versus Tracecat comparison ultimately comes down to ease of use in a managed product versus control in a self-hosted one. Neither is objectively better. It depends on what the team actually needs.
—
Shuffle: The Open Source SOAR Veteran
Before Tracecat, Shuffle was the name most commonly cited in open source SOAR discussions.
Shuffle runs on Docker and has a relatively mature architecture. Its community has built up a large library of prebuilt Apps, integration modules for specific security tools. VirusTotal, Shodan, Elastic, Splunk, PagerDuty, and most of the common security stack are covered. Teams can plug in existing tools without writing integration code from scratch.
Its visual workflow editor is friendlier to security analysts who do not write code regularly, compared to Tracecat’s more code-oriented playbook approach. The tradeoff is that Shuffle’s depth of customization is lower. Complex conditional logic and data transformation can become harder to manage visually than they would be in code.
Shuffle works well for teams that need fast onboarding, already use a standard security tool stack, and have mixed technical backgrounds. The App ecosystem can save a significant amount of integration effort up front.
—
TheHive: Case Management as the Core
TheHive occupies a different position than the other tools here. Its focus is not orchestrating automated workflows. It is managing the lifecycle of a security incident.
A security event travels through multiple phases from detection to closure: initial triage, evidence collection, attack tracing, remediation, and post-incident review. TheHive structures these into a case management system where each incident is a case, cases contain tasks, and tasks contain observables such as IP addresses, file hashes, and domain names.
The integration with Cortex is one of TheHive’s strongest features. Cortex is an analysis engine that can automatically enrich observables. Drop in an IP address, and Cortex queries VirusTotal, AbuseIPDB, and Shodan simultaneously, returning a consolidated report. This is particularly useful during forensic investigations.
Where TheHive falls short is in executing automated response actions. It functions more as a collaborative investigation platform than an engine that can automatically block an IP or isolate a host. Many teams combine TheHive with Shuffle or Tracecat: using TheHive for case management and the other tool for automated execution.
—
Putting the Four Tools Side by Side
Here is a comparison of the core differences.
| Dimension | Tracecat | Tines | Shuffle | TheHive |
|---|---|---|---|---|
| License | Open source (Apache 2.0) | Commercial (free tier available) | Open source (Apache 2.0) | Open source (AGPL) |
| Deployment | Self-hosted (Docker/K8s) | SaaS-first | Self-hosted (Docker) | Self-hosted (Docker) |
| Core strength | Python ecosystem, programmable playbooks | No-code, enterprise integrations | Rich App library, fast setup | Case management, forensic collaboration |
| Learning curve | Medium (playbook authoring required) | Low (drag-and-drop) | Low to medium | Medium |
| Automation execution | Strong | Strong | Strong | Weak (needs pairing) |
| Best fit | Small/mid technical teams | Mid/large enterprises | Mixed-skill teams | Small/mid, forensics-focused |
This table is not meant to declare a winner. It is meant to help you locate your team on the map.
The more fundamental question underneath the table: what is the biggest pain point your team faces right now?
If the answer is “too many alerts, not enough people, too much repetitive enrichment and triage work,” you need a strong execution engine. Tracecat or Shuffle are both worth testing. If the problem is “incidents are investigated in silos, findings are scattered, there is no shared case view,” TheHive’s case management addresses that directly. If budget allows and many analysts on the team are non-engineers, Tines’ no-code experience reduces the barrier significantly.
—
From Tool to Process
Picking the right tool is only the beginning. The harder part is embedding it into how the team actually works day to day.
A common mistake is assuming that deploying a SOAR platform automatically improves security operations. In practice, the platform’s value depends on how much institutional knowledge gets encoded into it. The more detailed the playbooks, the more scenarios they cover, the more the automation saves.
That means there is an investment phase. Existing response SOPs need to be translated into platform playbooks. Edge cases need testing. Playbooks need iteration against real alerts. This process can take weeks or months.
Tracecat’s advantage in this area is programmability. Python-based playbooks can be version-controlled, code-reviewed, and tested in CI/CD pipelines. For teams with a strong engineering culture, that workflow feels natural in a way that a drag-and-drop interface does not.
—
Questions Worth Answering Before You Commit
A few things worth thinking through before making a final decision.
Data sovereignty. If your alert data includes sensitive information such as customer data or internal credentials, self-hosted options have a clear advantage over SaaS. Both Tracecat and Shuffle can run entirely within your own environment.
Maintenance overhead. Open source self-hosting is not free. Someone on the team needs to handle deployment, upgrades, and monitoring of the platform itself. If the team is already stretched thin, that ongoing maintenance cost needs to be factored in.
Integration coverage. Which security tools does your team use today, and do they appear in the target platform’s integration library? Writing a custom integration is doable but takes time. Shuffle’s App ecosystem has the broadest coverage among the open source options. If your existing tools are already there, the setup effort drops considerably.
Team skill mix. Engineering-heavy teams tend to prefer Tracecat’s code-first approach. Teams that need non-engineering analysts to participate in building and modifying workflows will find Shuffle or Tines more approachable.
—
No Perfect Answer
Back to that 2 AM scenario.
With a well-configured SOAR in place, those alerts would move through an automated triage process first: IP enrichment, host correlation, alert grouping. By the time a human needs to make a call, the work arrives as a structured case with relevant context already attached, not as a flood of raw notifications across five different tools.
The automation does not replace human judgment. It directs human attention to where judgment actually matters.
No single tool makes every decision for you. Tracecat’s programmability gives it a real edge with technical teams, but it asks for an ongoing investment in playbook maintenance. Shuffle’s App ecosystem makes fast deployment possible, though deep customization has limits. TheHive is irreplaceable for structured case management, but it cannot carry a full automated response program on its own.
Which one fits depends on who your team is, where it is now, and where it needs to go.
Related reading
- n8n vs Activepieces: Choosing an Open-Source Workflow Automation Tool for Self-Hosted Teams
- Authentik Alternatives: Choosing an Open Source SSO for Small Teams (2026)
- One Developer, Seven Clones, and a Declaration That Software Is Over
- Stagehand Alternatives for Browser Automation: A 2026 Production Comparison
- Choosing AI Browser Automation Tools: Browser Use vs Stagehand vs Skyvern vs Playwright in 2026
Stay updated with our latest AI insights
