# Tracecat Docs ## Automations ### Overview - [Welcome to Tracecat](https://docs.tracecat.com/overview/introduction.md) - [Getting started](https://docs.tracecat.com/overview/getting-started.md) ### Building automations - [Tracecat MCP](https://docs.tracecat.com/automations/tracecat-mcp.md): Drive Tracecat from your own agent harness over MCP: build, edit, and run workflows and cases through Claude, Cursor, ChatGPT, or any MCP client. #### Core concepts - [Workflows](https://docs.tracecat.com/automations/workflows.md): Learn how Tracecat workflows work and how to manage them: run them manually, draft and publish definitions, tag and rename, and configure workflow settings. - [Actions](https://docs.tracecat.com/automations/actions.md): Learn how Tracecat actions work and how to configure them: action names and types, the action toolbar, success and error paths, and control flow. - [Tables](https://docs.tracecat.com/automations/tables.md): Store and manage structured data inside Tracecat: define tables, query rows from workflows and agents, and link records to cases and workflow runs. - [Expressions](https://docs.tracecat.com/automations/core-concepts/expressions.md): Syntax reference for Tracecat expressions: contexts, operators, functions, and JSONPath access patterns used inside workflow and agent definitions. - [Secrets](https://docs.tracecat.com/automations/core-concepts/secrets.md): Create, scope, and reference Tracecat secrets in workflows and agents: store API keys safely and inject them into actions through expressions. - [External secret stores](https://docs.tracecat.com/automations/core-concepts/external-secret-stores.md): Reference AWS Secrets Manager secrets from Tracecat workspaces: organization-owned stores, IAM AssumeRole trust, and runtime-only resolution. - [Variables](https://docs.tracecat.com/automations/core-concepts/variables.md): Create and reference reusable Tracecat workspace variables in workflows and agents: share configuration and constants across automations without duplicating values. - [Workflow metadata](https://docs.tracecat.com/automations/core-concepts/workflow-metadata.md): Read workflow run metadata in Tracecat expressions with the ENV context: execution IDs, timestamps, trigger type, and the active Workflow environment. - [Functions](https://docs.tracecat.com/automations/core-concepts/functions.md): Inline utility functions for Tracecat expressions: transform strings, dates, numbers, lists, and JSON inside workflow and agent definitions. - [JSONPath](https://docs.tracecat.com/automations/core-concepts/jsonpath.md): Path access reference for Tracecat expressions: navigate trigger payloads, action results, secrets, and variables with JSONPath syntax. - [Workflow definition](https://docs.tracecat.com/automations/core-concepts/workflow-definition.md): YAML reference for Tracecat workflow definitions: triggers, actions, inputs, outputs, control flow, and schema fields used to author and version workflows. #### Triggers - [Webhooks](https://docs.tracecat.com/automations/triggers/webhooks.md): Trigger Tracecat workflows from external systems with webhooks: configure secret URLs, parse JSON or form payloads, and validate inbound requests. - [Schedules](https://docs.tracecat.com/automations/triggers/schedules.md): Run Tracecat workflows on a time-based cadence: configure cron schedules, fixed intervals, and trigger payloads for recurring automations. - [Workflows-as-APIs](https://docs.tracecat.com/automations/triggers/workflows-as-apis.md): Call Tracecat workflows as synchronous HTTP APIs: block on the /wait webhook endpoint, read the response envelope, and fetch large results by download link. - [Error workflows](https://docs.tracecat.com/automations/triggers/error-workflows.md): Run a Tracecat workflow whenever another workflow fails: forward error context, alert on-call, and centralize incident-handling logic across automations. - [Case triggers](https://docs.tracecat.com/automations/triggers/case-triggers.md): Start Tracecat workflows from case events: react to case creation, status changes, and field updates to drive automated triage and response. - [Task triggers](https://docs.tracecat.com/automations/triggers/task-triggers.md): Run Tracecat workflows from case tasks: trigger automations as tasks are created, assigned, completed, or updated to keep response work moving. - [Comment triggers](https://docs.tracecat.com/automations/triggers/comment-triggers.md): Run Tracecat workflows from case comments and replies: parse comment text, route directives to actions and agents, and bridge analyst chat into automation. - [Forms](https://docs.tracecat.com/automations/triggers/forms.md): Turn a workflow's Input schema into a form that workspace members fill in, configure its layout in YAML, and read what people submit. #### Integrations - [Prebuilt credentials](https://docs.tracecat.com/automations/integrations/prebuilt-credentials.md): Configure prebuilt credentials for Tracecat's built-in integrations: define secret schemas, scope values per workspace, and reuse them across actions and agents. - [OAuth](https://docs.tracecat.com/automations/integrations/oauth-integrations.md): Connect OAuth providers to Tracecat and reference managed OAuth tokens in expressions: configure scopes, refresh credentials, and call APIs from actions and agents. - [MCP servers](https://docs.tracecat.com/automations/integrations/mcp-integrations.md): Connect MCP servers from the Tracecat catalog, or bring your own remote and stdio servers, and attach them to agents and presets. ### Building agents - [Workspace chat](https://docs.tracecat.com/agents/workspace-chat.md): Chat with Tracecat across your workspace, select tools and MCP integrations, and mention preset agents. - [AI action](https://docs.tracecat.com/agents/ai-action.md): Use `ai.action` to run a single LLM call in a workflow. - [AI agent](https://docs.tracecat.com/agents/ai-agent.md): Run tool-calling agents with Tracecat actions, MCP servers, structured outputs, approvals, and reusable presets. - [AI preset agent](https://docs.tracecat.com/agents/ai-preset-agent.md): Save reusable agent configurations with instructions, tools, skills, and MCP integrations, then run them from workflows and workspace chat. - [LLM providers](https://docs.tracecat.com/agents/llm-providers.md): Connect built-in LLM providers to Tracecat, enable their models for your organization, and choose the default model that agents use. - [Custom LLM providers](https://docs.tracecat.com/agents/custom-llm-providers.md): Configure custom OpenAI-compatible model providers for Tracecat agents: add a custom source, discover models, and enable them for presets and defaults. - [Skills](https://docs.tracecat.com/agents/skills.md): Create, publish, and attach Tracecat skills to preset agents so reusable instructions and files are available during agent runs. - [Secrets and variables](https://docs.tracecat.com/agents/secrets-variables.md): Pass Tracecat secrets and workspace variables to preset agent tool calls securely: scope credentials per agent run and inject values without exposing them to the model. - [Human-in-the-loop](https://docs.tracecat.com/agents/human-in-the-loop.md): `tool_approvals` and the agent inbox to review tool calls before they run. - [Channels](https://docs.tracecat.com/agents/channels.md): Chat with a preset agent and approve its tool calls from Slack. ### Building custom integrations - [Custom registry](https://docs.tracecat.com/custom-actions/custom-registry.md): Sync custom Python and YAML actions into Tracecat through your own registry: version, share, and reuse organization-specific automations across workspaces. - [Python UDFs](https://docs.tracecat.com/custom-actions/python-udf.md): Build custom Python actions for Tracecat: declare inputs and outputs, package dependencies, and expose user-defined functions to workflows and agents. - [YAML templates](https://docs.tracecat.com/custom-actions/yaml-template.md): Build custom YAML template actions for Tracecat: compose existing actions and expressions into reusable, versioned building blocks for workflows and agents. - [Local development](https://docs.tracecat.com/custom-actions/local-development.md): Hot-reload custom Python and YAML actions while developing locally against Tracecat: iterate on registry code with fast feedback loops and live workflow runs. ## Cases ### Case management - [Overview](https://docs.tracecat.com/automations/cases.md): Track and resolve Tracecat cases: triage alerts, run agents and workflows on case events, manage tasks and comments, and report on outcomes. ### Build cases - [Custom fields](https://docs.tracecat.com/automations/cases/custom-fields.md): Store workspace-specific data on every case, such as ticket IDs, affected hosts, verdicts, and analyst notes. - [Dropdowns](https://docs.tracecat.com/automations/cases/dropdowns.md): Add custom case classifications such as determination, escalation tier, or detection source, and filter the case list by them. - [Closure requirements](https://docs.tracecat.com/automations/cases/closure-requirements.md): Require custom fields and dropdowns to have values before a case can be closed or resolved. - [Case durations](https://docs.tracecat.com/automations/cases/durations.md): Measure elapsed time between case events, such as time to triage or time to resolution, and read the results from workflows. ### Resolve cases - [Linked rows](https://docs.tracecat.com/automations/cases/linked-rows.md): Link table rows to a case to keep structured evidence such as indicators, assets, and detections with the investigation. - [Case tasks](https://docs.tracecat.com/automations/cases/tasks.md): Break a case into follow-up work, assign owners, track progress, and start workflows from tasks. - [Mention agents in case comments](https://docs.tracecat.com/automations/cases/agent-mentions.md): Invoke a preset agent from a case comment, follow its reply, and inspect the full agent session. - [Correlations](https://docs.tracecat.com/automations/cases/correlations.md): Find other cases that link the same indicator, asset, or detection row. - [Workflow triggers](https://docs.tracecat.com/automations/cases/workflow-triggers.md): Run workflows from cases automatically on case events, from case tasks, or with a / command in a comment. ## Core Actions ### Request - [HTTP](https://docs.tracecat.com/automations/core-actions/request-actions/http.md) - [SQL](https://docs.tracecat.com/automations/core-actions/request-actions/sql.md) - [SSH](https://docs.tracecat.com/automations/core-actions/request-actions/ssh.md) - [gRPC](https://docs.tracecat.com/automations/core-actions/request-actions/grpc.md) - [Email](https://docs.tracecat.com/automations/core-actions/request-actions/email.md) ### Transform - [Reshape](https://docs.tracecat.com/automations/core-actions/transform-actions/reshape.md) - [Python script](https://docs.tracecat.com/automations/core-actions/transform-actions/python-script.md) - [Data transforms](https://docs.tracecat.com/automations/core-actions/transform-actions/data-transforms.md) - [Require](https://docs.tracecat.com/automations/core-actions/transform-actions/require.md) ### Workflow - [Run subflow](https://docs.tracecat.com/automations/core-actions/workflow-actions/run-subflow.md) - [Scatter-gather loops](https://docs.tracecat.com/automations/core-actions/workflow-actions/scatter-gather-loops.md) - [While loops](https://docs.tracecat.com/automations/core-actions/workflow-actions/while-loops.md) ### Agent - [AI agent](https://docs.tracecat.com/agents/ai-agent.md): Run tool-calling agents with Tracecat actions, MCP servers, structured outputs, approvals, and reusable presets. - [AI action](https://docs.tracecat.com/agents/ai-action.md): Use `ai.action` to run a single LLM call in a workflow. ### Case - [Cases](https://docs.tracecat.com/automations/core-actions/case-actions/cases.md) - [Comments](https://docs.tracecat.com/automations/core-actions/case-actions/comments.md) - [Attachments](https://docs.tracecat.com/automations/core-actions/case-actions/attachments.md) - [Tasks](https://docs.tracecat.com/automations/core-actions/case-actions/tasks.md) - [Linked rows](https://docs.tracecat.com/automations/core-actions/case-actions/linked-rows.md) ### Table - [Tables](https://docs.tracecat.com/automations/core-actions/memory-actions/tables.md) - [Columns](https://docs.tracecat.com/automations/core-actions/memory-actions/columns.md) - [Lookups](https://docs.tracecat.com/automations/core-actions/memory-actions/lookups.md) - [Rows](https://docs.tracecat.com/automations/core-actions/memory-actions/rows.md) - [Export](https://docs.tracecat.com/automations/core-actions/memory-actions/export.md) ### Form - [Forms](https://docs.tracecat.com/automations/core-actions/form-actions/forms.md) - [Integrations (113 pages)](https://docs.tracecat.com/_llms/integrations.txt): Documentation for Integrations. ## Cheatsheets ### Cheatsheets - [Functions](https://docs.tracecat.com/cheatsheets/functions.md): Quick reference for every Tracecat expression function and operator, with signatures and examples for transforming data inside workflows and agents. - [JSONPath](https://docs.tracecat.com/cheatsheets/jsonpath.md): Quick reference for JSONPath syntax, filters, and access patterns used in Tracecat expressions to read fields from triggers, actions, secrets, and variables. - [Common mistakes](https://docs.tracecat.com/cheatsheets/common-mistakes.md): Fixes for the most common Tracecat expression errors: null guards, bracket indexing, YAML quoting, empty literals, and Python syntax that does not parse. - [Transformations](https://docs.tracecat.com/cheatsheets/transformations.md): Recipes for common data transformations in Tracecat workflows: merging results, joining lists to table rows, date windows, filters, branch rejoins, and deduplicated writes. - [Aggregate and search](https://docs.tracecat.com/cheatsheets/aggregate-and-search.md): Recipes for filtering, grouping, and summarizing cases and table rows, and for searching table rows by meaning, from workflows and agents. - [Workflow metadata](https://docs.tracecat.com/cheatsheets/workflow-metadata.md): Quick reference for the ENV fields available in Tracecat expressions: workflow run identifiers, timestamps, trigger type, and Workflow environment. ## Platform ### Self-hosting - [Docker Compose](https://docs.tracecat.com/self-hosting/docker-compose.md): Deploy self-hosted Tracecat using Docker Compose: bring up the API, executor, worker, frontend, Postgres, and Temporal stack on a single host in minutes. - [Scaling action throughput](https://docs.tracecat.com/self-hosting/scaling.md): Size a Docker Compose deployment for a target sustained action throughput: executor replicas, concurrency settings, PostgreSQL connections, and host hardware from the default settings up to 256 actions per second. - [AWS ECS Fargate](https://docs.tracecat.com/self-hosting/aws-fargate.md): Deploy self-hosted Tracecat to AWS ECS Fargate using Terraform: provision RDS, networking, secrets, and Temporal alongside Tracecat services in your own AWS account. - [Kubernetes](https://docs.tracecat.com/self-hosting/kubernetes.md): Deploy self-hosted Tracecat to Kubernetes with the OCI Helm chart: install Tracecat services and Temporal on EKS, GKE, or any conformant cluster. - [Air-gapped deployment](https://docs.tracecat.com/self-hosting/air-gapped.md): Run Tracecat on Kubernetes with zero runtime internet connectivity, internal dependencies, and self-hosted LLM inference. - [Temporal retention](https://docs.tracecat.com/self-hosting/temporal-retention.md): Increase Temporal workflow history retention for self-hosted Tracecat on Docker Compose, AWS ECS Fargate, and Kubernetes, and archive closed workflow histories to S3. - [Architecture](https://docs.tracecat.com/self-hosting/architecture.md): Architecture overview for self-hosted Tracecat: services, networking, authentication boundaries, and dependencies between API, executor, worker, LiteLLM, and frontend. - [Set up pgvector](https://docs.tracecat.com/self-hosting/pgvector.md): Install pgvector for the Tracecat application database and resolve migration errors. - [TLS and certificates](https://docs.tracecat.com/self-hosting/tls.md): Configure HTTPS for self-hosted Tracecat: automatic Let's Encrypt certificates with Caddy, custom certificates, and trusting internal CAs for outbound connections. - [Environment variables](https://docs.tracecat.com/self-hosting/environment-variables.md): Reference for every self-hosted Tracecat environment variable: configure auth, storage, secrets, integrations, and runtime behavior across services. - [Security](https://docs.tracecat.com/self-hosting/security.md): Harden your self-hosted Tracecat deployment: replace default infrastructure credentials, generate and store platform secrets, sandbox executor code, and set up SSO and TLS. ### Manage platform - [User management](https://docs.tracecat.com/manage-platform/users.md): Bootstrap the first superadmin, control who can register, and invite users into an organization. - [Roles and permissions](https://docs.tracecat.com/manage-platform/rbac.md): Review each member's roles, workspaces, and groups, change a member's roles, and look up what each built-in role can do. - [IP allowlist](https://docs.tracecat.com/manage-platform/ip-allowlist.md): Restrict sign-in and API access for an organization to approved IP addresses and ranges, and review where each session connects from. - [Custom roles and groups](https://docs.tracecat.com/manage-platform/custom-roles.md): Create custom roles and groups, add members to groups, assign roles to groups, and invite members into groups. - [Service accounts](https://docs.tracecat.com/manage-platform/service-accounts.md): Create machine identities that hold scopes directly and authenticate to the Tracecat REST API with an API key. - [Git sync](https://docs.tracecat.com/manage-platform/git-sync.md): Export workspace configuration to GitHub, GitLab, or Bitbucket as a pull request, then pull a reviewed commit into another workspace. - [Tunnels](https://docs.tracecat.com/manage-platform/tunnels.md): Connect Tracecat to private and on-premises services, such as an internal Splunk, through Pangolin tunnels restricted to exact hosts and ports. ### Authentication - [Basic](https://docs.tracecat.com/authentication/basic.md): Authenticate into self-hosted Tracecat with basic email-and-password sign-in: configure user accounts, password policies, and admin bootstrap for small deployments. - [SAML SSO](https://docs.tracecat.com/authentication/saml.md): Authenticate into Tracecat with SAML SSO: configure your identity provider, map attributes, and enable single sign-on for organization-wide access. - [OIDC](https://docs.tracecat.com/authentication/oidc.md): Authenticate into Tracecat using OpenID Connect: register an OIDC client with your IdP, map claims, and enable SSO sign-in across the platform. - [SCIM provisioning](https://docs.tracecat.com/authentication/scim.md): Provision users and groups from Okta, Microsoft Entra ID, or any SCIM 2.0 identity provider, and map synced groups onto Tracecat groups. ### Security - [Architecture](https://docs.tracecat.com/security/architecture.md): Understand Tracecat's threat model and security design. - [Platform audit logs](https://docs.tracecat.com/audit-logs/platform.md): Stream platform administrator actions to an HTTPS webhook and separate them from organization audit events. - [Organization audit logs](https://docs.tracecat.com/audit-logs/organization.md): Stream organization audit events to an HTTPS webhook and shape each request for your log collector. - [Organization agent logs](https://docs.tracecat.com/audit-logs/agents.md): Export OpenTelemetry metrics, log events, and traces for agent runs to your observability backend. - [MCP access logs](https://docs.tracecat.com/audit-logs/mcp-access.md): Review OAuth connections, personal access tokens, and external MCP client activity in a workspace. - [API Reference (560 pages)](https://docs.tracecat.com/_llms/api-reference.txt): Documentation for API Reference. ## OpenAPI Specs - [openapi](https://platform.tracecat.com/api/openapi.json) > The links below point to documentation indexes. Follow each `/_llms/` index recursively until you reach documentation pages. ## Indexes - [Integrations (113 pages)](https://docs.tracecat.com/_llms/integrations.txt): Documentation for Integrations. - [API Reference (560 pages)](https://docs.tracecat.com/_llms/api-reference.txt): Documentation for API Reference. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.