Detect

Tracecat | Documentation

What is Tracecat?

Introduction

Installation

Admins and users

Everything you need to know to get started with Tracecat.

Quickstart

Building blocks of Tracecat workflows and action templates.

Core Actions

Reference action outputs, webhook payloads, secrets, and more.

Expressions

Store and retrieve sensitive data in workflows.

Secrets

Learn how to use webhooks and schedules to trigger workflows.

Workflow triggers

Build and sync custom integrations from a private Git repository into Tracecat.

Custom integrations

Build and execute workflows of workflows.

Child workflows

Loop and process lists of data with child workflows.

Explode-implode

Filter and manipulate data with transform actions and inline functions.

Data transforms

Alert on failure

Learn how to self-host Tracecat on your own infrastructure.

Overview

Learn how to safely update versions and run data migrations.

Updating Tracecat

Learn how to self-host LLMs in Tracecat with Ollama.

Self-hosted LLMs

JSON

Arrays

Datetimes

Strings

Booleans

Cryptography

Pre-built integrations and response actions in both YAML and Python.

Action Templates

Python UDFs

Learn how to develop custom integrations for Tracecat locally.

Local Development

Best Practices

Notify

Isolate

Evict

Model

Harden

Introduction to the Tracecat security automation platform.

Learn Tracecat basics by building the classic VirusTotal enrichment playbook.

Learn how to use if-conditions in your workflows.

Control Flow

Learn how to use and modify pre-built integrations in your workflows.

Actions Registry

Learn how to combine smaller workflows into a single workflow.

Child Workflows

Learn how to trigger workflows via webhooks or schedules.

Workflow Triggers

Learn how to add custom integrations to the Actions Registry.

Custom Integrations

Deploy Tracecat using a Docker Compose template.

Docker Compose

Use Terraform to deploy Tracecat into ECS Fargate.

AWS ECS Fargate

Learn how to configure authentication with Tracecat.

Learn how to authenticate into Tracecat with email and password.

Basic

Learn how to authenticate into Tracecat using Google OAuth.

Google OAuth

Learn how to authenticate into Tracecat with SAML SSO

SAML SSO

Actions

Reference action results and workflow metadata in your workflows

Learn how to work with lists of items in your workflows.

Arrays, loops, and filters

A cheatsheet of all operators and functions supported by Tracecat.

Functions

A cheatsheet of all the integrations and their required secrets.