https://cybertoolchain.io/tools/shuffle New releases and features in Shuffle, tracked by The Cyber Toolchain. en Tue, 20 Oct 2026 11:57:11 GMT https://github.com/Shuffle/Shuffle/releases/tag/v2.3.1-rc1 https://github.com/Shuffle/Shuffle/releases/tag/v2.3.1-rc1 Tue, 20 Oct 2026 11:57:11 GMT Shuffle v2.3.1-rc1 adds graceful worker stop for AI Agent actions in hybrid deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves app name resolution and workflow execution validation when the executor is an AI Agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.3.0 https://github.com/Shuffle/Shuffle/releases/tag/v2.3.0 Mon, 28 Sep 2026 13:57:49 GMT Shuffle v2.3.0 brings on-prem/hybrid AI Agents, air-gapped app builds, and automatic stuck-execution reruns via Orborus.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SHUFFLE_BASE_IMAGE_REGISTRY` and `SHUFFLE_BASE_IMAGE_NAME` config settings for consistent custom/private registry behavior across all deployment types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables AI Agents to run in on-premises and hybrid setups, picking the correct backend address and tool timeouts, recovering late-arriving results, and using local AI credentials or Shuffle AI synced from the cloud. • Adds automatic rerun system within Orborus to detect and restart stuck workflow executions, reducing the need for manual intervention. • Supports a custom App SDK image for building apps in disconnected or air-gapped environments on self-hosted installations. • Improves live workflow update streaming, including AI-generated edits, with more reliable change history and reconnection handling, and reduces background polling when only one person is viewing a workflow. • Includes Shuffle Security in both the Docker Compose configuration and Kubernetes Helm chart for easier self-hosted deployment. • Refines AI Agent and MCP action app/tool name matching by searching workflows to find the correct action, with added execution and permission checks on agent-initiated runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.3.0-rc2 https://github.com/Shuffle/Shuffle/releases/tag/v2.3.0-rc2 Wed, 23 Sep 2026 09:42:25 GMT Shuffle v2.3.0-rc2 adds graceful worker stop for AI Agent actions in hybrid deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds graceful stop handling for AI Agent actions during hybrid worker execution, preventing runaway processes when an agent-driven workflow terminates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.2.2-rc1 https://github.com/Shuffle/Shuffle/releases/tag/v2.2.2-rc1 Wed, 27 May 2026 13:27:48 GMT Shuffle v2.2.2-rc1 adds per-app proxy passing without affecting workers. • Adds a proxy passing option that forwards proxies to apps independently of workers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-12052026 https://github.com/Shuffle/Shuffle/releases/tag/nightly-12052026 Tue, 12 May 2026 14:25:11 GMT Shuffle nightly adds queue management changes for on-premises deployments. • Adds queue management controls for on-premises Shuffle installations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.2.1-nightly-1775748107 https://github.com/Shuffle/Shuffle/releases/tag/v2.2.1-nightly-1775748107 Thu, 09 Apr 2026 15:23:54 GMT Helm chart gains values to enable Shuffle debug mode per component. • Adds Helm chart values to enable Shuffle debug mode on a per-component basis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.2.1-nightly-1774453486 https://github.com/Shuffle/Shuffle/releases/tag/v2.2.1-nightly-1774453486 Wed, 25 Mar 2026 15:45:06 GMT Shuffle adds Azure DevOps sync integration for workflow automation. • Adds Azure DevOps sync feature, enabling integration between Shuffle and Azure DevOps pipelines/projects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-1771869385 https://github.com/Shuffle/Shuffle/releases/tag/nightly-1771869385 Mon, 23 Feb 2026 17:56:59 GMT Shuffle adds AI Agent App support in hybrid mode, on-prem MCP action execution, and Helm-based Kubernetes worker/app deployments. • Enables AI Agent App support in hybrid mode so on-prem workers can leverage cloud-side AI agent apps. • Adds `runMCPAction` support on-prem, enabling Model Context Protocol action execution in self-hosted deployments. • Supports deploying Shuffle worker and app containers via Helm charts for Kubernetes environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-1770615681 https://github.com/Shuffle/Shuffle/releases/tag/nightly-1770615681 Mon, 09 Feb 2026 05:41:52 GMT Shuffle nightly adds multi-region cloud sync support and smarter Kubernetes worker deployment checks. • Adds multi-region support for cloud sync, enabling distributed deployments across geographic regions. • Checks for existing worker deployments in Kubernetes before deploying, preventing duplicate rollouts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.1.3 https://github.com/Shuffle/Shuffle/releases/tag/v2.1.3 Fri, 19 Dec 2025 11:51:07 GMT Shuffle v2.1.3 adds Helm-based k8s deployment, auto-enrichment for datastore keys, vendor-neutral AI support, and air-gapped licensing. • Adds auto-enrichment for datastore keys, reducing manual lookup steps in workflows. • Introduces vendor-neutral AI environment variable support and enables AI-powered documentation query answers. • Supports static workflow IDs for more predictable multi-tenant and automation pipeline configurations. • Adds multi-tenant child org workflow execution statistics for better visibility across org hierarchies. • Defaults Kubernetes deployments to Helm charts, streamlining k8s rollout and configuration. • Enables secret deployment via Kubernetes for more secure credential management in k8s environments. • Defaults app replicas to 3 for improved out-of-the-box scalability. • Adds configurable k8s resource limits (CPU/memory) for app and worker containers via Helm. • Supports tmp volume mounting for apps in k8s deployments. • Adds explicit app protocol specification for worker and app services in k8s. • Introduces new licensing features and air-gapped subscription compliance support. • Adds cloud-only billing display options and improved cloud UI sync for subscription data. • Supports flexible subflow streaming and ordering modifications for schedule/deletion logic. • Major OpenSearch/Elasticsearch refactor for v8 compatibility with enhanced health checks. Breaking changes: • The `SHUFFFLE_SWARM_CONFIG` environment variable is removed from Orborus in k8s deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-31102025 https://github.com/Shuffle/Shuffle/releases/tag/nightly-31102025 Fri, 31 Oct 2025 13:41:47 GMT Shuffle nightly adds Kubernetes tmp volume mounts for apps and explicit app protocol specification for worker/app services. • Supports mounting a tmp volume to apps in Kubernetes deployments. • Enables specifying the app protocol for worker and app services in Kubernetes. • Adds more licensing features. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-30102025 https://github.com/Shuffle/Shuffle/releases/tag/nightly-30102025 Thu, 30 Oct 2025 15:58:18 GMT Shuffle nightly adds Kubernetes tmp volume mounts, app protocol specification, and expanded licensing features. • Supports mounting a tmp volume to apps in Kubernetes deployments. • Enables explicit app protocol specification for worker and app services in Kubernetes. • Adds expanded licensing features. Breaking changes: • App replicas now default to 3 in Kubernetes deployments, which may increase resource consumption on upgrade if replica count was previously unset. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/2.1.1-rc1-09102025 https://github.com/Shuffle/Shuffle/releases/tag/2.1.1-rc1-09102025 Thu, 09 Oct 2025 12:52:27 GMT Shuffle 2.1.1-rc1 adds configurable Kubernetes resource limits for workers and cloud subscription sync. • Adds option to set Kubernetes resource limits and requests for worker deployments via Helm chart. • Enables cloud sync for subscription data, keeping subscription state aligned between cloud and self-hosted instances. • Caches cloud sync data to reduce redundant remote calls during synchronization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-09102025 https://github.com/Shuffle/Shuffle/releases/tag/nightly-09102025 Thu, 09 Oct 2025 12:50:36 GMT Shuffle nightly adds configurable Kubernetes resource limits for workers and cloud subscription sync. • New option to set Kubernetes resource requests/limits (CPU, memory) for worker pods in Helm deployments. • Adds cloud sync for subscription data, keeping licensing state consistent across cloud-connected instances. • Caches cloud sync data locally to reduce repeated remote lookups. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-23092025-v1 https://github.com/Shuffle/Shuffle/releases/tag/nightly-23092025-v1 Tue, 23 Sep 2025 17:16:41 GMT Shuffle nightly adds local AI model auto-detection and Kubernetes resource/env var controls for workers and apps. • Detects local/self-hosted AI model availability automatically during backend startup. • Propagates the `SHUFFLE_LOGS_DISABLED` environment variable from Orborus through to worker and app containers in Kubernetes deployments. • Supports setting CPU/memory resource limits and requests for worker and app pods via Helm values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.1.0 https://github.com/Shuffle/Shuffle/releases/tag/v2.1.0 Tue, 23 Sep 2025 14:32:28 GMT Shuffle 2.1.0 adds local/self-hosted AI model support, Datastore Categories, Protected Keys, and custom dashboards via new stats API. • Supports local and self-hosted AI models: connect any OpenAI-compatible LLM by supplying a URL, model name, and API key so AI Agents run fully on-premises. • Generates workflows from plain-text descriptions or flowcharts using AI. • Adds AI-assisted workflow editing with keyboard shortcuts. • Introduces Datastore Categories for structured key organization across alerts, tickets, users, and IOCs, with category-based search and deduplication. • Adds Protected Keys so secrets can be used safely in workflows via best-effort fuzzy hashing. • Adds bulk datastore APIs with pagination, supporting up to 500 key lookups per request. • Adds Custom Dashboards with user-defined metrics via POST /api/v1/stats. • New Statistics & Observability features: workflow execution views, top run/failure tracking, historical debug search, notifications, and multi-tenant org views. • Admin view for child organization activity tracking in multi-tenant deployments. • App container auto-scaling based on request rate, CPU usage, and queue depth. • Detects local/self-hosted AI model availability automatically during backend startup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/2.1.0-nightly-02072025 https://github.com/Shuffle/Shuffle/releases/tag/2.1.0-nightly-02072025 Wed, 02 Jul 2025 14:55:03 GMT Shuffle 2.1.0-nightly re-adds /api/v1/orgs and adds Kubernetes/Helm security contexts, configurable app ports, and service labels. • Re-adds the `/api/v1/orgs` API endpoint. • Adds Helm chart support for specifying custom service labels. • Enables setting security contexts for worker and app containers in Kubernetes deployments. • Allows changing the exposed app port in Kubernetes deployments. • Adds theming support for on-premises installations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.1.0-rc2 https://github.com/Shuffle/Shuffle/releases/tag/v2.1.0-rc2 Wed, 18 Jun 2025 09:03:17 GMT Shuffle v2.1.0-rc2 adds HA for Orborus, public Datastore Categories with automation, and bulk datastore updates. • Adds High Availability and failover tracking for Orborus in both cloud and on-prem environments. • Enables making Datastore Categories public, allowing teams to subscribe to others' published threat lists or publish their own detection rulesets — managed via /admin?tab=datastore. • Adds Datastore Category Automation: categories can now natively trigger workflow runs or send webhooks when data changes. • Supports bulk setting of Datastore entries, with categories now able to handle hundreds of thousands of entries. • Introduces a Partner & Use Case management system for organizational and workflow flexibility. • Adds sub-organization deletion UI with verification button and associated cache management. • Adds ability to skip SSO for admins on sub-organizations. • Enables Singul to automatically upload translations to the Shuffle Datastore, plus a new frontend library for managing apps and authentication in third-party platforms. • Upgrades backend search to OpenSearch 3.0.0. • Adds Helm chart support for specifying service labels, security contexts for worker and app containers, and configurable exposed app port. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.0.2 https://github.com/Shuffle/Shuffle/releases/tag/v2.0.2 Thu, 03 Apr 2025 21:16:35 GMT Shuffle 2.0.2 adds AI Agent support with self-hosted LLMs, per-action rerun, and new branding controls for integration partners. • Adds AI Agent support with bring-your-own LLM provider, enabling fully open-source on-premises deployments. • New 'Rerun' feature lets practitioners re-execute any single workflow action in isolation using data from the last run. • New branding controls including light mode and button removal for integration partners. • Adds alignment and resize controls for workflow comment nodes, including text location and sizing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v2.0.1 https://github.com/Shuffle/Shuffle/releases/tag/v2.0.1 Fri, 21 Mar 2025 01:19:01 GMT Shuffle 2.0.1 adds self-service region switching, SSO credential hiding, and role assignment from SSO providers. • Enables self-service cloud region changes via the /admin panel — no support ticket required. • Adds credential hiding on the SSO page for Organizations. • Supports role assignment synced from SSO providers on login. • Improves control of Forms for Workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/2.0.0 https://github.com/Shuffle/Shuffle/releases/tag/2.0.0 Mon, 03 Mar 2025 10:43:52 GMT Shuffle 2.0 adds multi-tenant workflows, open-sourced scale worker, Sigma detection UI, hotload API, auto-scale, and a Helm chart. • Adds multi-tenant workflow support, enabling isolated workflow execution across multiple tenants. • Open-sources the scale worker, making distributed execution infrastructure available for self-hosted deployments. • New UI with redesigned app page, workflow page, and discovery mechanisms. • Adds Sigma detection UI for managing and visualizing Sigma rules directly in the platform. • New API endpoint for hotloading specific applications without restarting the service. • Adds auto-scale support for on-prem worker deployments. • Heavily improved observability across workflow executions. • Adds Datastore Categorization (indexing) for structured data organization. • Adds Forms and Publishing mechanisms for workflow interaction and distribution. • Docker Compose now uses Docker Swarm by default for on-prem deployments. • Adds official Shuffle Helm chart for Kubernetes deployments. • Mounts TLS certificates to each worker container automatically. • Adds window-swapping feature in the workflow editor UI. • Variable fields in action parameters now update dynamically in the workflow editor. • Adds branch direction flipping in the workflow canvas. • Adds UI tooltips across the workflow editor. • Syncs on-prem feature pages with cloud feature parity. Breaking changes: • Docker Compose is now configured to use Docker Swarm by default, which may break existing non-Swarm on-prem deployments that rely on plain Compose orchestration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/nightly-14122024 https://github.com/Shuffle/Shuffle/releases/tag/nightly-14122024 Sat, 14 Dec 2024 12:00:53 GMT Shuffle nightly adds auto-scaling, a redesigned App page, and automatic TLS cert mounting to workers. • Adds auto-scale support for on-premises worker deployments. • Introduces a redesigned App page with updated modals for browsing and creating apps. • Mounts TLS certificates to each worker container automatically. • Updates docker-compose to use Docker Swarm mode by default. • Adds a synced app creation modal for streamlined app onboarding. • Introduces a redesigned Workflow page UI. Breaking changes: • The docker-compose configuration now uses Docker Swarm mode by default, which may break existing single-host Docker Compose deployments that are not configured for Swarm. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/2.0.0-nightly-02112024 https://github.com/Shuffle/Shuffle/releases/tag/2.0.0-nightly-02112024 Sat, 02 Nov 2024 13:30:30 GMT Shuffle 2.0.0-nightly adds Sigma detection UI, app hotloading endpoint, window swapping, and branch direction flipping. • Adds Sigma detection UI for building and managing Sigma rules directly in the workflow interface. • New API endpoint for hotloading specific applications without restarting the service. • Adds window swapping capability in the workflow editor. • Adds branch direction flipping in the workflow canvas. • Variable fields in action parameters now update dynamically. • Adds tip-section support in in-product documentation. • Improves the app builder UI. • Adds UI tooltips to workflow editor controls. • Kubernetes keep-alive support for Orborus. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v1.4.0 https://github.com/Shuffle/Shuffle/releases/tag/v1.4.0 Wed, 22 May 2024 16:54:39 GMT Shuffle v1.4 adds distributed Log Ingester with Sigma, App Auth overrides for subflows, and Datastore public interfaces. • Run Shuffle as a distributed Log Ingester using Sigma rules • Add "Custom action" to App Creator apps allowing modifyable URL path and authentication • Start workflows from Message queues & Kafka via Orborus on-premises environment • Search workflow executions by keyword in the Workflow Run Debugger (`/workflows/debug`) • Select related tenants in the admin view (`/admin?tab=suborgs`) • Access new admin dashboard at `/admin2` • Override App Auth for subflows called from parent workflows • Use sub-org distribution system to share workflows from parent org to suborgs • Update Trigger UI to contain Pipelines, Webhook & Triggers together • Retrieve Datastore keys values in JSON/CSV formats via public interface • Delete user accounts for on-prem users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v1.3.3 https://github.com/Shuffle/Shuffle/releases/tag/v1.3.3 Thu, 07 Mar 2024 16:21:28 GMT Shuffle v1.3.3 adds built-in KMS with third-party secret provider support and a Tenzir trigger. • Adds a `KMS` (Key Management System) integration to encrypt secrets in the database with support for third party secret providers • Adds a new third party data pipeline trigger for `Tenzir` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/1.3.1 https://github.com/Shuffle/Shuffle/releases/tag/1.3.1 Thu, 07 Dec 2023 21:47:07 GMT Shuffle 1.3.1 adds Rerun execution API, per-tenant notifications, and split proxy config. • Adds the `Rerun execution` API endpoint to allow replaying previous workflow executions • Makes Notifications org-wide (per tenant) and expands the events on which they trigger • Introduces Single Action executions for tasks like Code Editor testing • Allows running Python directly in the Code Editor by selecting the 'Execute Python' action • Adds configuration to split Proxy settings between External APIs and Shuffle resources • Updates Condition nodes (Smaller Than, Larger Than) to respect type, removing the need for `{{ ["list"] | size }}` workarounds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/v1.3.0 https://github.com/Shuffle/Shuffle/releases/tag/v1.3.0 Sun, 19 Nov 2023 23:16:37 GMT Shuffle v1.3.0 adds ShuffleGPT, a /api/v1/health/stats API, Kubernetes scaling, workflow versioning and realtime collaboration. • Adds `/api/v1/health/stats` endpoint for retrieving historic workflow performance statistics and checking downtime status on cloud and onprem instances • Introduces 'ShuffleGPT', an AI-driven feature accessible at https://shuffler.io/conversation to solve simple queries like finding last tickets and eventually generating workflows • Enables realtime workflow collaboration, similar to Google Docs or Figma, currently in Beta and disabled by default • Adds Kubernetes support as a new scaling option for Shuffle workers • Adds 'Workflow Versioning' allowing users to view past revisions of workflows • Adds 'Workflow Run Explorer' at `/workflows/debug` to help identify workflow bugs over time • Supports OAuth2 Application Permissions within the App Creator • Integrates an OpenAPI Generator powered by Generative AI, available as an option on the /apps page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/1.1.0 https://github.com/Shuffle/Shuffle/releases/tag/1.1.0 Tue, 06 Dec 2022 18:46:49 GMT Shuffle 1.1 introduces workflow templating, stats API on /api/v1/orgs/{orgid}/stats, distributed caching, and a file editor for detection methods. • Adds `templating` system for generating workflows • Adds statistics to the background API endpoint `/api/v1/orgs/{orgid}/stats` • Adds distributed caching mechanism with Memcached • Adds File Editing and Categories via the `/admin?tab=files` interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle https://github.com/Shuffle/Shuffle/releases/tag/1.0.0 https://github.com/Shuffle/Shuffle/releases/tag/1.0.0 Wed, 27 Apr 2022 16:24:03 GMT Shuffle 1.0 introduces SSO (SAML/OpenID), Swarm config for Orborus, Liquid formatting in apps, and workflow priority queues. • `Added SSO with SAML and OpenID PKCE` to enable identity provider authentication. • `Added Swarm configuration possibility for Orborus` to allow distributed worker management. • `Added Liquid Formatting to apps` allowing dynamic content rendering within app workflows. • `Added priority for when workflows execute` to manage queue load and execution order. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/shuffle