🤖

Shieldlix SOAR

Automate incident response from alert to resolution. Playbooks, connectors, and case management in one platform.

Architecture

Loading diagram...

Technology Stack

Rust
Core runtime — memory-safe, zero-cost abstractions, no garbage collector
Axum
HTTP framework — type-safe routing, tower middleware, WebSocket support
Tokio
Async runtime — work-stealing scheduler, millions of concurrent I/O operations
Kafka
Event streaming — durable alert pipeline, exactly-once semantics
Workflow Engine
DAG-based playbook execution with step-level approval and rollback
S3/MinIO
Evidence storage — immutable, versioned, legal-hold capable object storage
Next.js 16
React 19 SSR/SSG — streaming, server components, optimistic UI
React 19
UI framework — concurrent rendering, transitions, Suspense

Core Features

📋

Playbook Execution

Pre-built playbooks for ransomware containment, identity threat response, data exfiltration, and more.

🔗

Integration Connectors

15 connector types: EDR, IAM, Firewall, DNS, Proxy, Email, SaaS, Cloud, Ticketing, Chat.

📁

Case Management

Full lifecycle: Open, In Progress, Pending Approval, Contained, Closed. Auto-queue by severity.

✅

Approval Workflows

Multi-step approval chains. Critical incidents require both responder and approver roles.

📎

Evidence Management

S3-backed evidence storage with retention policies, legal hold, and access request workflows.

⏱️

SLA Tracking

Targets: Critical 15min, High 60min, Medium 4hr, Low 24hr. Escalation on breach.

📝

Audit Trail

Append-only log for every action: alert ingestion, case updates, playbook runs, approvals.

🔌

Connector Actions

Isolate host, disable user, open ticket, notify channel, quarantine file with idempotency.

Pre-Built Playbooks

Contain Ransomware

Critical
1Collect endpoint evidence
2Isolate host (approval)
3Open recovery ticket

Contain Identity Threat

High
1Collect identity evidence
2Revoke sessions
3Disable user (approval)

Data Exfiltration Response

Critical
1Preserve DLP evidence
2Block cloud share (approval)
3Open privacy ticket

Security Analytics Abuse

High
1Collect query history
2Restore rule state (approval)
3Notify detection owner

Case Lifecycle

Open→
In Progress→
Pending Approval→
Contained→
Closed

How Shieldlix Compares

Feature
Shieldlix
Splunk SOAR
Cortex XSOAR
MS Sentinel
Pricing
Free. No per-playbook or per-connector fees.
Separate SOAR license. Premium add-on.
Per-automation pricing. ~$60K+/yr.
Included with Sentinel but per-connector costs.
Pre-Built Playbooks
4 playbooks covering top incident types
75+ playbooks. Visual VPE editor.
800+ playbooks. Largest marketplace.
Logic Apps templates. Requires Azure knowledge.
Execution Engine
Code-based Rust engine. Sub-second step execution.
Python-based. Visual drag-and-drop.
Python/JavaScript. Docker-based integration.
Azure Logic Apps. Serverless, event-driven.
Approval Workflows
Multi-step chains with role-based approval
Built-in approval tasks in playbooks
Task-level approvals with SLA timers
Requires custom Logic App configuration
Evidence Storage
S3-backed with retention, legal hold, audit
Attachments in case. No retention policy.
War room attachments. Limited retention.
Azure Blob storage. Configurable.
SLA Tracking
Built-in: Critical 15m, High 60m, Medium 4hr
Configurable SLA timers per playbook
SLA management with escalation policies
Requires custom metrics and alerts
Audit Trail
Append-only log for all actions. Immutable.
Case activity log. Not tamper-proof.
Full audit log with change tracking
Azure Activity Log integration
Case Management
Full lifecycle with severity-based auto-queue
Unified TDIR with analyst queue
Incidents with layout builder
Incidents in Defender portal
Third-Party Integrations
15 connector types. Mock + live dispatch.
300+ apps, 2,800+ actions
700+ integrations. REST/Python-based.
400+ connectors via Logic Apps
Deployment
Docker Compose + K8s. Self-hosted, no lock-in.
Splunk Cloud or on-prem.
SaaS or on-prem. Cortex XSOAR license.
Azure SaaS only.
SIEM Integration
Native. Alert → Playbook in same platform.
Native (same vendor). Best integration.
Generic SIEM integration. Requires config.
Native with Sentinel alerts.
MTTR Impact
Automated containment in minutes. Free.
Significant MTTR reduction with SOAR.
Industry-leading MTTR metrics.
Good with Azure-native automation.

Cost Comparison

Annual SOAR platform costs by automation volume. Shieldlix is always free.

Automation Volume
Splunk SOAR
Cortex XSOAR
MS Sentinel
Shieldlix
50 playbooks/mo
~$60,000/yr
~$72,000/yr
~$12,000/yr
$0
200 playbooks/mo
~$60,000/yr
~$72,000/yr
~$24,000/yr
$0
500 playbooks/mo
~$60,000/yr
~$84,000/yr
~$48,000/yr
$0

Ready to automate your SOC?

Free forever. No credit card. No usage limits.

Competitors charge $60K–$84K/yr. Shieldlix is free.