> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # Functions > Quick reference for every Tracecat expression function and operator, with signatures and examples for transforming data inside workflows and agents. ## Examples Build a prompt or short string: ```yaml Expression theme={null} prompt: ${{ FN.format("Investigate alert {0} with severity {1}", TRIGGER.alert_id, TRIGGER.severity) }} ``` ```json Result theme={null} { "prompt": "Investigate alert al-123 with severity high" } ``` Time manipulation for alert search windows: ```yaml Expression theme={null} start_time: ${{ FN.to_isoformat(FN.now() - FN.minutes(15)) }} end_time: ${{ FN.to_isoformat(FN.now()) }} ``` ```json Result theme={null} { "start_time": "2026-03-18T12:45:00", "end_time": "2026-03-18T13:00:00" } ``` Deserialize or serialize JSON: ```yaml Expression theme={null} parsed: ${{ FN.deserialize_json(TRIGGER.raw_json) }} serialized: ${{ FN.serialize_json({"status": "ok", "count": 3}) }} ``` ```json Result theme={null} { "parsed": { "status": "open", "count": 3 }, "serialized": "{\"status\":\"ok\",\"count\":3}" } ``` Format rows into a Markdown table: ```yaml Expression theme={null} table: ${{ FN.to_markdown_table(ACTIONS.list_findings.result) }} ``` ```json Result theme={null} { "table": "| id | severity |\n| --- | --- |\n| f-1 | high |\n| f-2 | medium |" } ``` Count or reshape a small value: ```yaml Expression theme={null} count: ${{ FN.length(ACTIONS.gather_results.result) }} unique_tags: ${{ FN.unique(TRIGGER.tags) }} ``` ```json Result theme={null} { "count": 3, "unique_tags": ["auth", "critical"] } ``` This page is generated from `tracecat/expressions/functions.py`. ## Function reference `FN.add(a: float | int, b: float | int) -> float | int` Add two numbers together. `FN.and(a: bool, b: bool) -> bool` Logical AND operation. `FN.at(sequence: Sequence[Any], index: int) -> Any` Return the element at the given index. `FN.capitalize(x: str) -> str` Capitalize a string. `FN.check_ip_version(ip: str) -> int` Get IP address version (4 or 6). `FN.compact(x: list[Any]) -> list[Any]` Drop null values from a list. Similar to compact function in Terraform. `FN.concat(*items: str) -> str` Concatenate multiple strings. `FN.contains(item: Any, container: Sequence[Any]) -> bool` Check if item exists in a sequence. Aliases: `FN.is_in` `FN.contains_any_of(a: Sequence[Any], b: Sequence[Any]) -> bool` Check if any of the elements of the first sequence exist in the second sequence. `FN.contains_none_of(a: Sequence[Any], b: Sequence[Any]) -> bool` Check if all of of the elements of the first sequence don't exist in the second sequence. `FN.datetime(year: int, month: int, day: int, hour: int = 0, minute: int = 0, second: int = 0) -> datetime` Create datetime from year, month, day, hour, minute, and second. `FN.days(x: int) -> timedelta` Create timedelta with specified days. `FN.days_between(start: datetime | str, end: datetime | str) -> float` Days between two datetimes. `FN.deserialize_json(obj, /)` Deserialize JSON to Python objects. `FN.deserialize_ndjson(x: str) -> list[dict[str, Any]]` Parse newline-delimited JSON string into list of objects. `FN.deserialize_yaml(x: str) -> Any` Deserialize YAML string to object. `FN.difference(a: Sequence[Any], b: Sequence[Any]) -> list[Any]` Return a list of elements that are in the first sequence but not in the second. `FN.div(a: float | int, b: float | int) -> float` Divide first number by second number. `FN.does_not_contain(item: Any, container: Sequence[Any]) -> bool` Check if item does not exist in a sequence. Aliases: `FN.is_not_in`, `FN.not_in` `FN.drop_nulls(items: list[Any]) -> list[Any]` Remove all null or empty string values from a list. `FN.endswith(x: str, suffix: str) -> bool` Check if a string ends with a specified suffix. `FN.extract_asns(text: str) -> list[str]` Extract Autonomous System Numbers, e.g. AS1234, from a string. `FN.extract_cves(text: str) -> list[str]` Extract CVE IDs, such as CVE-2021-34527, from a string. `FN.extract_domains(text: str, include_defanged: bool = False) -> list[str]` Extract domain names from a string. `FN.extract_emails(text: str, normalize: bool = False) -> list[str]` Extract unique emails from a string. When `normalize` is True, lowercases the email and strips the subaddress (the `+...` part before `@`). `FN.extract_ip(text: str, include_defanged: bool = False) -> list[str]` Extract unique IPv4 and IPv6 addresses from a string. `FN.extract_ipv4(text: str, include_defanged: bool = False) -> list[str]` Extract unique IPv4 addresses from a string. `FN.extract_ipv6(text: str, include_defanged: bool = False) -> list[str]` Extract unique IPv6 addresses from a string. Includes defanged variants as an option. `FN.extract_mac(text: str) -> list[str]` Extract MAC addresses from a string. `FN.extract_md5(text: str) -> list[str]` Extract MD5 hashes from a string. `FN.extract_sha1(text: str) -> list[str]` Extract SHA1 hashes from a string. `FN.extract_sha256(text: str) -> list[str]` Extract SHA256 hashes from a string. `FN.extract_sha512(text: str) -> list[str]` Extract SHA512 hashes from a string. `FN.extract_urls(text: str, http_only: bool = False, include_defanged: bool = False) -> list[str]` Extract URLs from text, optionally including defanged ones. `FN.flatten(iterables: Sequence[Sequence[Any]]) -> list[Any]` Flatten nested sequences into a single list. `FN.flatten_dict(x: str | dict[str, Any] | list[Any], max_depth: int = 100) -> dict[str, Any]` Return object with single level of keys (as jsonpath) and values. `FN.format(template: str, *values: Any) -> str` Format a string with the given arguments. `FN.format_datetime(x: datetime | str, format: str) -> str` Format datetime into specified format (e.g. '%Y-%m-%d %H:%M:%S'). `FN.from_base64(x: str) -> str` Decode base64 string to string. `FN.from_base64url(x: str) -> str` Decode URL-safe base64 string to string. `FN.from_timestamp(x: float | int | str, unit: str = s) -> datetime` Convert timestamp in milliseconds ('ms') or seconds ('s') to datetime. `FN.get_day(x: datetime | str) -> int` Get day of month (1-31) from datetime. `FN.get_day_of_week(x: datetime | str, format: "Literal[number, full, short]" = number) -> int | str` Extract day of week from datetime. Returns 0-6 (Mon-Sun) or day name if format is "full" or "short". `FN.get_hour(x: datetime | str) -> int` Get hour (0-23) from datetime. `FN.get_interaction() -> dict[str, str] | None` Get the interaction context from the current action in the workflow execution. `FN.get_minute(x: datetime | str) -> int` Get minute (0-59) from datetime. `FN.get_month(x: datetime | str, format: "Literal[number, full, short]" = number) -> int | str` Extract month from datetime. Returns 1-12 or month name if format is "full" or "short". `FN.get_second(x: datetime | str) -> int` Get second (0-59) from datetime. `FN.get_year(x: datetime | str) -> int` Get year from datetime. `FN.greater_than(a: Any, b: Any) -> bool` Check if a is greater than b. `FN.greater_than_or_equal(a: Any, b: Any) -> bool` Check if a is greater than or equal to b. `FN.hash_md5(x: str | bytes) -> str` Generate MD5 hash of input string or bytes. `FN.hash_sha1(x: str | bytes) -> str` Generate SHA1 hash of input string or bytes. `FN.hash_sha256(x: str | bytes) -> str` Generate SHA256 hash of input string or bytes. `FN.hash_sha512(x: str | bytes) -> str` Generate SHA512 hash of input string or bytes. `FN.hours(x: int) -> timedelta` Create timedelta with specified hours. `FN.hours_between(start: datetime | str, end: datetime | str) -> float` Hours between two datetimes. `FN.intersection(a: Sequence[Any], b: Sequence[Any]) -> list[Any]` Return a list containing the intersection of elements from two sequences. `FN.ipv4_in_subnet(ipv4: str, subnet: str) -> bool` Check if IPv4 address is in the given subnet. `FN.ipv4_is_public(ipv4: str) -> bool` Check if IPv4 address is public/global. `FN.ipv6_in_subnet(ipv6: str, subnet: str) -> bool` Check if IPv6 address is in the given subnet. `FN.ipv6_is_public(ipv6: str) -> bool` Check if IPv6 address is public/global. `FN.is_empty(x: Sequence[Any]) -> bool` Check if sequence has length 0. `FN.is_equal(a: Any, b: Any) -> bool` Check if a is equal to b. `FN.is_in(item: Any, container: Sequence[Any]) -> bool` Check if item exists in a sequence. Aliases: `FN.contains` `FN.is_json(x: str) -> bool` Check if a string is valid JSON. `FN.is_not_empty(x: Sequence[Any]) -> bool` Check if sequence has length greater than 0. Aliases: `FN.not_empty` `FN.is_not_equal(a: Any, b: Any) -> bool` Check if a is not equal to b. Aliases: `FN.not_equal` `FN.is_not_in(item: Any, container: Sequence[Any]) -> bool` Check if item does not exist in a sequence. Aliases: `FN.does_not_contain`, `FN.not_in` `FN.is_not_null(x: Any) -> bool` Check if value is not None. Aliases: `FN.not_null` `FN.is_null(x: Any) -> bool` Check if value is None. `FN.is_working_hours(x: datetime | str, start: str, end: str, include_weekends: bool = False, timezone: str | None = None) -> bool` Check if datetime is between two times (HH:MM or HH:MM:SS strings). `FN.iter_product(*iterables: Sequence[Any]) -> list[tuple[Any, ...]]` Generate cartesian product of sequences. `FN.join(items: Sequence[str], sep: str) -> str` Join sequence of strings with separator. `FN.length(obj, /)` Return the number of items in a container. `FN.less_than(a: Any, b: Any) -> bool` Check if a is less than b. `FN.less_than_or_equal(a: Any, b: Any) -> bool` Check if a is less than or equal to b. `FN.lookup(d: dict[Any, Any], k: Any) -> Any` Safely get value from an object. `FN.lowercase(x: str) -> str` Convert string to lowercase. `FN.map_keys(x: dict[str, Any], keys: dict[str, str]) -> dict[str, Any]` Map keys in an object to new keys. `FN.max(a: Any, b: Any) -> Any` Return the maximum of two values. `FN.merge(x: list[dict[Any, Any]]) -> dict[Any, Any]` Merge list of objects. Similar to merge function in Terraform. `FN.min(a: Any, b: Any) -> Any` Return the minimum of two values. `FN.minutes(x: int) -> timedelta` Create timedelta with specified minutes. `FN.minutes_between(start: datetime | str, end: datetime | str) -> float` Minutes between two datetimes. `FN.mod(a: float | int, b: float | int) -> float | int` Calculate modulo (remainder) of first number divided by second. `FN.mul(a: float | int, b: float | int) -> float | int` Multiply two numbers together. `FN.normalize_email(email: str) -> str` Convert sub-addressed email to a normalized email address. `FN.not(x: bool) -> bool` Logical NOT operation. `FN.not_empty(x: Sequence[Any]) -> bool` Check if sequence has length greater than 0. Aliases: `FN.is_not_empty` `FN.not_equal(a: Any, b: Any) -> bool` Check if a is not equal to b. Aliases: `FN.is_not_equal` `FN.not_in(item: Any, container: Sequence[Any]) -> bool` Check if item does not exist in a sequence. Aliases: `FN.does_not_contain`, `FN.is_not_in` `FN.not_null(x: Any) -> bool` Check if value is not None. Aliases: `FN.is_not_null` `FN.now(as_isoformat: bool = False, timespec: str = auto) -> datetime | str` Return workflow logical time (local, naive) or current time if outside workflow. `FN.or(a: bool, b: bool) -> bool` Logical OR operation. `FN.parse_csv(x: str) -> list[dict[str, Any]]` Parse CSV string into list of objects. `FN.parse_datetime(x: str, format: str) -> datetime` Parse string to datetime using specified format. `FN.parse_time(x: str) -> time` Parse HH:MM:SS or HH:MM formatted string to a time object. `FN.pow(a: float | int, b: float | int) -> float | int` Raise first number to the power of second number. `FN.prefix(x: str | list[str], prefix: str) -> str | list[str]` Add a prefix to a string or list of strings. `FN.prettify_json(x: Any) -> str` Convert object to formatted JSON string. `FN.range(start: int, end: int, step: int = 1) -> list[int]` Create a range of integers from start to end (exclusive), with a step size. `FN.regex_extract(pattern: str, text: str) -> str | None` Extract the first captured group from text; fallback to full match if none. `FN.regex_match(pattern: str, text: str) -> bool` Check if text matches regex pattern. `FN.regex_not_match(pattern: str, text: str) -> bool` Check if text does not match regex pattern. `FN.replace(x: str, old: str, new: str) -> str` Replace all occurrences of old substring with new substring. `FN.seconds(x: int) -> timedelta` Create timedelta with specified seconds. `FN.seconds_between(start: datetime | str, end: datetime | str) -> float` Seconds between two datetimes. `FN.serialize(x: Any) -> str` Serialize a JSON-compatible value to string. `FN.serialize_json(x: Any) -> str` Convert object to JSON string. `FN.serialize_yaml(x: Any) -> str` Serialize object to YAML string. `FN.set_timezone(x: datetime | str, timezone: str) -> datetime` Convert datetime to different timezone. Timezone must be a valid IANA timezone name (e.g., "America/New\_York"). `FN.slice(x: str, start_index: int, length: int) -> str` Extract a substring from start\_index with given length. `FN.slugify(x: str) -> str` Slugify a string. `FN.split(x: str, sep: str) -> list[str]` Split a string into a list of strings by a seperator. `FN.startswith(x: str, suffix: str) -> bool` Check if a string starts wit a specified suffix. `FN.strip(x: str, chars: str) -> str` Removes all leading and trailing characters. `FN.sub(a: float | int, b: float | int) -> float | int` Subtract second number from first number. `FN.suffix(x: str | list[str], suffix: str) -> str | list[str]` Add a suffix to a string or list of strings. `FN.sum(iterable: Iterable[float | int], start: float | int = 0) -> float | int` Return the sum of a 'start' value (default: 0) plus an iterable of numbers. `FN.symmetric_difference(a: Sequence[Any], b: Sequence[Any]) -> list[Any]` Return a list of elements that are in either sequence but not in both. `FN.tabulate(x: list[dict[str, typing.Any]], format: Literal[markdown, html, csv, xml]) -> str` Format list of objects into `markdown`, `html`, `csv`, or `xml` `FN.titleize(x: str) -> str` Convert a string to titlecase. `FN.to_base64(x: str) -> str` Encode string to base64. `FN.to_base64url(x: str) -> str` Encode string to URL-safe base64. `FN.to_datetime(x: Any, timezone: str | None = None) -> datetime` Convert to timezone-aware datetime object from timestamp (in seconds), ISO 8601 string or existing datetime. `FN.to_isoformat(x: datetime | str, timespec: str = auto) -> str` Convert datetime to ISO format string. `FN.to_keys(x: dict[Any, Any]) -> list[Any]` Extract keys from an object. `FN.to_markdown_list(x: list[str], ordered: bool = False) -> str` Format list of strings into Markdown list. `FN.to_markdown_table(x: list[dict[str, typing.Any]]) -> str` Format list of dictionaries into Markdown table. `FN.to_markdown_tasks(x: list[str]) -> str` Format list of strings into Markdown tasks. `FN.to_time(x: datetime | str) -> time` Convert datetime to time. `FN.to_timestamp(x: datetime | str, unit: str = s) -> int` Convert datetime to timestamp in milliseconds ('ms') or seconds ('s'). `FN.to_values(x: dict[Any, Any]) -> list[Any]` Extract values from an object. `FN.today() -> date` Return workflow logical time date (local) or current date if outside workflow. `FN.union(a: Sequence[Any], b: Sequence[Any]) -> list[Any]` Return a list containing the union of elements from two sequences. `FN.unique(items: Sequence[Any]) -> list[Any]` List of hashable items (e.g. strings, numbers) to remove duplicates from. `FN.unset_timezone(x: datetime | str) -> datetime` Remove timezone information from datetime without changing the time. `FN.uppercase(x: str) -> str` Convert string to uppercase. `FN.url_decode(x: str) -> str` Converts percent-encoded characters back into their original form. `FN.url_encode(x: str) -> str` Converts URL-unsafe characters into percent-encoded characters. `FN.utcnow(as_isoformat: bool = False, timespec: str = auto) -> datetime | str` Return workflow logical time (UTC, aware) or current UTC time if outside workflow. `FN.uuid4() -> str` Generate a random UUID string. `FN.wall_clock(as_isoformat: bool = False, timespec: str = auto) -> datetime | str` Return actual current wall clock time (local, naive). `FN.weeks(x: int) -> timedelta` Create timedelta with spcified weeks `FN.weeks_between(start: datetime | str, end: datetime | str) -> float` Weeks between two datetimes or dates. `FN.windows_filetime(x: datetime | str) -> int` Convert datetime to Windows filetime. `FN.zip(*iterables: Sequence[Any]) -> list[tuple[Any, ...]]` Zip multiple sequences together. `FN.zip_map(x: list[str], y: list[str]) -> dict[str, str]` Zip two arrays into list of key-value pairs, then convert into mapping. ## Operator equivalents Equivalent function names: `FN.or` Equivalent function names: `FN.and` Equivalent function names: `FN.is_equal` Equivalent function names: `FN.is_not_equal`, `FN.not_equal` Equivalent function names: `FN.less_than` Equivalent function names: `FN.less_than_or_equal` Equivalent function names: `FN.greater_than` Equivalent function names: `FN.greater_than_or_equal` Equivalent function names: `FN.add` Equivalent function names: `FN.sub` Equivalent function names: `FN.mul` Equivalent function names: `FN.div` Equivalent function names: `FN.mod` Equivalent function names: `FN.contains`, `FN.is_in` Equivalent function names: `FN.does_not_contain`, `FN.is_not_in`, `FN.not_in`