!function(){var e,t,n;e="df1e807b970398a",t=function(){Reo.init({clientID:"df1e807b970398a"})},(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",n.defer=!0,n.onload=t,document.head.appendChild(n)}();


Overview

Tracecat | Documentation

What is Tracecat?

Introduction

Installation

User admin

Everything you need to know to get started with Tracecat.

Quickstart

Building blocks of Tracecat workflows and action templates.

Core actions

Execute custom Python scripts in a sandboxed environment.

Script actions

If-conditions, looped actions, and branching logic.

Control flow

Reference action outputs, webhook payloads, secrets, and more.

Expressions

Store and retrieve sensitive data in workflows.

Secrets

Learn how to use webhooks and schedules to trigger workflows.

Workflow triggers

Build and execute workflows of workflows.

Child workflows

Filter and manipulate data with transform actions and inline functions.

Data transforms

Split, transform, and merge lists of data with scatter and gather actions.

Scatter-gather

Define wait until, require, and retry until logic in workflows.

Wait, require, and retry

Build and sync custom integrations from a private Git repository into Tracecat.

Custom integrations

Alert on failure

Learn how to self-host Tracecat on your own infrastructure.

Learn how to safely update versions and run data migrations.

Updating Tracecat

Pre-built integrations and response actions in both YAML and Python.

Action templates

Python UDFs

Learn how to develop custom integrations for Tracecat locally.

Local development

Convert OpenAPI specs to Tracecat Action Templates.

Convert OpenAPI specs

A cheatsheet of functions and operators supported by Tracecat.

Functions

A cheatsheet of core actions, integrations, and credentials supported by Tracecat.

Integrations

A cheatsheet for YAML basic syntax, block modifiers, and special characters.

YAML

A cheatsheet for JSONPath syntax and filters.

JSONPath

Introduction to the Tracecat security automation platform.

Learn Tracecat basics by building the classic VirusTotal enrichment playbook.

Learn how to use if-conditions in your workflows.

Control Flow

Learn how to use and modify pre-built integrations in your workflows.

Actions Registry

Learn how to combine smaller workflows into a single workflow.

Child Workflows

Learn how to trigger workflows via webhooks or schedules.

Workflow Triggers

Learn how to add custom integrations to the Actions Registry.

Custom Integrations

Deploy Tracecat using a Docker Compose template.

Docker Compose

Use Terraform to deploy Tracecat into ECS Fargate.

AWS ECS Fargate

Learn how to self-host LLMs in Tracecat with Ollama.

Self-hosted LLMs

Learn how to configure authentication with Tracecat.

Learn how to authenticate into Tracecat with email and password.

Basic

Learn how to authenticate into Tracecat using Google OAuth.

Google OAuth

Learn how to authenticate into Tracecat with SAML SSO

SAML SSO

Actions

Reference action results and workflow metadata in your workflows

Learn how to work with lists of items in your workflows.

Arrays, loops, and filters

A cheatsheet of all operators and functions supported by Tracecat.

A cheatsheet of all the integrations and their required secrets.

REST API

Endpoints

Overview