Expressions

Overview

Tracecat expressions let you build values from trigger data, action results, secrets, variables, and functions. Expressions use ${{ ... }}.

Where expressions are used

You can use expressions in:

Action inputs
run_if
for_each
Action environment
Workflow environment
Output schema

Use var.<name> in action inputs for actions that run with for_each.

Expression contexts

Use these references inside expressions:

TRIGGER.<field>
ACTIONS.<ref>.result
SECRETS.<name>.<KEY>
VARS.<name>.<key>
ENV.<field>
var.<name>
FN.<name>(...)

Operators

Expressions support literals and operators.

Literals

String literals such as "high" and 'prod'
Numeric literals such as 1 and 3.14
Boolean literals such as True and False
Null literals such as None
List literals such as ["a", "b"]
Object literals with string keys such as {"severity": "high"}

Operators

Logical operators: || and &&
Comparison operators such as ==, !=, <, <=, >, >=
Arithmetic operators such as +, -, *, /, %
Ternary expressions such as ${{ "p1" if TRIGGER.severity == "high" else "p3" }}

Python-style or / and and SQL-style OR / AND are not supported.

Examples

Basic trigger reference:

text: "Alert ${{ TRIGGER.alert_id }}"

{
  "text": "Alert al-123"
}

Action result reference:

value: ${{ ACTIONS.fetch_alert.result }}

{
  "value": {
    "id": "al-123",
    "status": "open"
  }
}

Secret reference:

token: ${{ SECRETS.github.GITHUB_TOKEN }}

{
  "token": "ghp_xxxxx"
}

Variable reference:

team: ${{ VARS.routing.team }}

{
  "team": "secops"
}

Conditional execution:

run_if: ${{ FN.is_equal(TRIGGER.severity, "high") }}

{
  "run_if": true
}

Iteration:

for_each: ${{ for var.alert in TRIGGER.alerts }}

[
  {
    "var.alert": {
      "id": "al-1",
      "severity": "high"
    }
  },
  {
    "var.alert": {
      "id": "al-2",
      "severity": "low"
    }
  }
]

Using var.<name> in action inputs:

title: ${{ var.alert.title }}
severity: ${{ var.alert.severity }}

{
  "title": "Suspicious login",
  "severity": "high"
}

Ternary:

priority: ${{ "p1" if TRIGGER.severity == "high" else "p3" }}

{
  "priority": "p1"
}

Function call:

created_at: ${{ FN.to_datetime(TRIGGER.created_at) }}

{
  "created_at": "2026-03-18T09:00:00"
}

Nested list literal:

value: ${{ [1, [2, 3], {"severity": "high", "flags": [True, False, None]}] }}

{
  "value": [
    1,
    [2, 3],
    {
      "severity": "high",
      "flags": [true, false, null]
    }
  ]
}

Nested object literal:

value: ${{ {"alert": {"id": "al-123", "tags": ["auth", "critical"]}, "ok": True, "meta": None} }}

{
  "value": {
    "alert": {
      "id": "al-123",
      "tags": ["auth", "critical"]
    },
    "ok": true,
    "meta": null
  }
}

FAQ

How do I safely reference action results when an upstream action was skipped, failed, or returned null?

Some actions only return data in certain conditions. For example, a hash enrichment might find no matches in your threat intel source. When a field does not exist, the expression resolves to None — no error is raised.Use run_if with a != None check to skip downstream actions when the data is missing, or use a ternary to supply a fallback value.

- ref: check_hash
  action: tools.virustotal.get_file_report
  args:
    hash: ${{ TRIGGER.file_hash }}

- ref: escalate_alert
  action: tools.slack.post_message
  depends_on:
    - check_hash
  run_if: ${{ ACTIONS.check_hash.result != None && ACTIONS.check_hash.result.malicious_count != None }}
  args:
    channel: ${{ SECRETS.slack.SECURITY_CHANNEL }}
    text: "Hash ${{ TRIGGER.file_hash }} flagged by ${{ ACTIONS.check_hash.result.malicious_count }} vendors"

- ref: build_summary
  action: core.transform.reshape
  depends_on:
    - check_hash
  args:
    value:
      verdict: ${{ ACTIONS.check_hash.result.verdict if ACTIONS.check_hash.result != None else "unknown" }}
      is_known_bad: ${{ ACTIONS.check_hash.result.malicious_count > 0 if ACTIONS.check_hash.result.malicious_count != None else False }}

See Workflow definition for where expressions appear in workflow YAML.
See JSONPath for field access, arrays, and filters.
See Functions for the full function reference.

Overview

Building automations

Building agents

Building custom actions

Self-hosting

Authentication

Audit logs

Overview

Where expressions are used

Expression contexts

Operators

Literals

Operators

Examples

FAQ

​Overview

​Where expressions are used

​Expression contexts

​Operators

​Literals

​Operators

​Examples

​FAQ

​Related pages

Overview

Where expressions are used

Expression contexts

Operators

Literals

Operators

Examples

FAQ

Related pages