Skip to main content

​
Alerting → Shuffle (notifications & automation)

CoPilot integrates with Shuffle to run automation/playbooks and send notifications (Teams/Slack/Jira/email/webhooks) when:
  • a new Alert is ingested into Incident Management, or
  • an analyst manually triggers a Case workflow.
This is the recommended way to extend CoPilot alerting into external systems without needing a custom integration inside CoPilot for every downstream tool.

​
Video walkthrough

🎥 Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle
⚠️ Note: the video sets the Shuffle connector URL to https://shuffler.io. Shuffle Cloud now runs region-specific API backends, and your workflow only exists on the backend for your org’s region. If your Shuffle org is not in the US region, set the connector URL to your regional endpoint (e.g. https://eu.shuffler.io) — otherwise the connector verifies but workflow lookups fail and notifications silently don’t run. See the region table in the full guide.

​
Read the full guide

  • CoPilot ↔ Shuffle Integration (Admin/Operator): ../shuffle-integration.md
  • Graylog management (detections): ./graylog-management.md
  • Incident sources (mapping context): ./incident-sources.md
  • Alerts (SIEM view): ./alerts-siem.md