ANALISIS PERFORMA WORKFLOW SOC PADA SOFTWARE OPEN SOURCE N8N DAN SHUFFLE YANG TERINTEGRASI REAL TIME DENGAN SIEM DAN THREAT INTELLIGENCE

Abstract

The rapid growth of digital infrastructure increases the complexity of cyber threats, bringing operational challenges to modern Security Operations Centers (SOCs) such as high alert volumes and alert fatigue. Security Orchestration, Automation, and Response (SOAR) addresses this issue, but commercial solutions are often too expensive for Small and Medium Enterprises (SMEs). Open source workflow automation platforms offer a more responsive, stable, and suitable alternative for building automation with an affordable financing scale. This study aims to analyze and compare the performance of two open source platforms, n8n and Shuffle, integrated in real time with Security Information and Event Management (SIEM) and threat intelligence. An experimental quantitative method was used to evaluate performance under two load scenarios: a light load of 100 requests and a heavy load of 1,000 requests. Both scenarios were conducted on the same server environment running Ubuntu Server 22.04 with an Intel Xeon E5540 14 core processor and 16 GB of RAM, using n8n version 2.25.7 and Shuffle version 2.2.0. The evaluated metrics include CPU usage, RAM usage, node latency, total workflow latency, throughput, and tail latencies (p95 and p99). The results indicate that n8n outperformed Shuffle across all evaluated metrics. Under a heavy load of 1000 requests, n8n recorded a lower average CPU usage of 1.96% and RAM usage of 4968.06 MB, compared to Shuffle which reached 16.21% and 9118.83 MB, respectively. Furthermore, n8n demonstrated a significantly lower average total workflow latency of 2.476 seconds compared to Shuffle's 12.94 seconds, alongside a higher throughput capacity. In conclusion, n8n provides more stable and faster automation performance with lower resource consumption, making it highly suitable for fulfilling SOC automation requirements in SME environments.