Core actions

Core actions are the building blocks of Tracecat workflows and action templates. All core actions are under the core namespace. They are distinct from pre-built integrations in the tools namespace, which are pre-configured for specific 3rd-party tools.

There are four sub-namespaces under core:

• core
• core.transform
• core.workflow
• core.require

core actions are the most commonly used actions in Tracecat. They include:

​

Reshape

Reshape is a simple action that takes a single input value (e.g. a string, number, or object), evaluates any expressions and functions, and returns the result.

The following examples show common use-cases and inputs for the Reshape action.

# Get one value from a previous action
value: ${{ ACTIONS.get_user.result.data.user.name }}

# Get multiple values from a previous action
value:
  name: ${{ ACTIONS.get_user.result.data.user.name }}
  email: ${{ ACTIONS.get_user.result.data.user.email }}

# Get data from the trigger
value: ${{ TRIGGER.data.user }}

​

HTTP Request

The core.http_request action supports GET, POST, PUT, PATCH, and DELETE requests.

• To make a GET request with query parameters, specify the params field.
• To make a POST, PUT, or PATCH request with:
  • JSON encoded body, specify the payload field.
  • Form-encoded data, specify the form_data field.
• To make a request with a custom HTTP headers, specify the headers field.

Examples

url: https://api.open-meteo.com/v1/forecast
method: GET
params:
  latitude: 37.773972
  longitude: -122.431297
  current: temperature_2m,precipitation_probability

​

HTTP Polling

Tracecat makes it easy to poll APIs with long-running operations using the core.http_poll action. To configure the core.http_poll action, you’ll need to specify one of the following inputs:

• poll_retry_codes: List of status codes on which the action will retry.
• poll_condition: A Python lambda function string that determines whether to retry.

If the operation doesn’t poll on a status code, poll_condition is required. It is a Python lambda function string that determines whether to retry based on:

• headers: The HTTP headers of the response.
• data: The JSON decoded response body.

For example, to poll on a response body containing "status" until it equals "complete", you can specify the following:

poll_condition: "lambda x: x['data']['status'] == 'complete'"

You can further configure the polling behavior via the optional inputs:

• poll_interval: Seconds between polling attempts. Defaults to exponential wait.
• poll_max_attempts: Maximum number of polling attempts. Defaults to 10.

​

Tutorial: URLScan

URLScan uses a two-step process to get a threat intelligence report on a URL:

1. Call the /scan endpoint to submit the URL for scanning.
2. Poll the /result endpoint repeatedly until the status code changes from 404 to 200.
3. Uses a reshape to extract the maliciousness score and categories from the response body.

url: https://urlscan.io/api/v1/scan/
method: POST
headers:
  API-key: ${{ SECRETS.urlscan.URLSCAN_API_KEY }}
payload:
  url: https://crowdstrikebluescreen.com
  visibility: private

url: https://urlscan.io/api/v1/result/${{ ACTIONS.scan_url.result.data.uuid }}
method: GET
poll_retry_codes: [404]
headers:
  API-key: ${{ SECRETS.urlscan.URLSCAN_API_KEY }}

value:
  verdict: ${{ ACTIONS.lookup_url.result.data.verdicts.urlscan.malicious }}
  score: ${{ ACTIONS.lookup_url.result.data.verdicts.urlscan.score }}