!function(){var e,t,n;e="df1e807b970398a",t=function(){Reo.init({clientID:"df1e807b970398a"})},(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",n.defer=!0,n.onload=t,document.head.appendChild(n)}();


Create Case

Case priority values aligned with urgency levels.

Values:
    UNKNOWN (0): No priority is assigned
    LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible
    MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available
    HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible
    CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative
    OTHER (99): The priority is not normalized

CasePriority

Case severity values aligned with OCSF severity values.

Values:
    UNKNOWN (0): The event/finding severity is unknown
    INFORMATIONAL (1): Informational message. No action required
    LOW (2): The user decides if action is needed
    MEDIUM (3): Action is required but the situation is not serious at this time
    HIGH (4): Action is required immediately
    CRITICAL (5): Action is required immediately and the scope is broad
    FATAL (6): An error occurred but it is too late to take remedial action
    OTHER (99): The event/finding severity is not mapped

CaseSeverity

Case status values aligned with OCSF Incident Finding status.

CaseStatus

Location

Message

Error Type

ValidationError

CaseCreate

APIKeyCookie

APIKeyHeader

HTTPValidationError

Tracecat | Documentation

What is Tracecat?

Introduction

Installation

User admin

Everything you need to know to get started with Tracecat.

Quickstart

Building blocks of Tracecat workflows and action templates.

Core actions

Execute custom Python scripts in a sandboxed environment.

Script actions

If-conditions, looped actions, and branching logic.

Control flow

Reference action outputs, webhook payloads, secrets, and more.

Expressions

Store and retrieve sensitive data in workflows.

Secrets

Learn how to use webhooks and schedules to trigger workflows.

Workflow triggers

Build and execute workflows of workflows.

Child workflows

Filter and manipulate data with transform actions and inline functions.

Data transforms

Split, transform, and merge lists of data with scatter and gather actions.

Scatter-gather

Define wait until, require, and retry until logic in workflows.

Wait, require, and retry

Build and sync custom integrations from a private Git repository into Tracecat.

Custom integrations

Alert on failure

Learn how to self-host Tracecat on your own infrastructure.

Overview

Learn how to safely update versions and run data migrations.

Updating Tracecat

Pre-built integrations and response actions in both YAML and Python.

Action templates

Python UDFs

Learn how to develop custom integrations for Tracecat locally.

Local development

Convert OpenAPI specs to Tracecat Action Templates.

Convert OpenAPI specs

A cheatsheet of functions and operators supported by Tracecat.

Functions

A cheatsheet of core actions, integrations, and credentials supported by Tracecat.

Integrations

A cheatsheet for YAML basic syntax, block modifiers, and special characters.

YAML

A cheatsheet for JSONPath syntax and filters.

JSONPath

Introduction to the Tracecat security automation platform.

Learn Tracecat basics by building the classic VirusTotal enrichment playbook.

Learn how to use if-conditions in your workflows.

Control Flow

Learn how to use and modify pre-built integrations in your workflows.

Actions Registry

Learn how to combine smaller workflows into a single workflow.

Child Workflows

Learn how to trigger workflows via webhooks or schedules.

Workflow Triggers

Learn how to add custom integrations to the Actions Registry.

Custom Integrations

Deploy Tracecat using a Docker Compose template.

Docker Compose

Use Terraform to deploy Tracecat into ECS Fargate.

AWS ECS Fargate

Learn how to self-host LLMs in Tracecat with Ollama.

Self-hosted LLMs

Learn how to configure authentication with Tracecat.

Learn how to authenticate into Tracecat with email and password.

Basic

Learn how to authenticate into Tracecat using Google OAuth.

Google OAuth

Learn how to authenticate into Tracecat with SAML SSO

SAML SSO

Actions

Reference action results and workflow metadata in your workflows

Learn how to work with lists of items in your workflows.

Arrays, loops, and filters

A cheatsheet of all operators and functions supported by Tracecat.

A cheatsheet of all the integrations and their required secrets.

REST API

Endpoints

Create Case

Authorizations

Query Parameters

Body

Response