> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scanner

> Reference for the Tracecat Scanner integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Cancel Scanner query

Action ID: `tools.scanner.cancel_query`

Cancel a previously started asynchronous Scanner query.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="query_run_id" type="string" required>
  Query run ID (`qr_id`) returned by `tools.scanner.start_query`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Create Scanner detection rule

Action ID: `tools.scanner.create_detection_rule`

Create a detection rule in Scanner.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="description" type="string" required>
  Description of the detection rule.
</ParamField>

<ParamField path="enabled_state_override" type="string" required>
  Scanner enabled state, such as Active, Staging, or Paused.
</ParamField>

<ParamField path="event_sink_ids" type="array[string]" required>
  Event sink IDs that receive alerts from this detection rule.
</ParamField>

<ParamField path="name" type="string" required>
  Name of the detection rule.
</ParamField>

<ParamField path="query_text" type="string" required>
  Scanner query text for the detection rule.
</ParamField>

<ParamField path="run_frequency_s" type="integer" required>
  Run frequency in seconds. Scanner requires minute granularity and a value no greater than `time_range_s`.
</ParamField>

<ParamField path="severity" type="string" required>
  Detection severity accepted by Scanner, such as Information, Low, Medium, High, Critical, Fatal, or Other.
</ParamField>

<ParamField path="tenant_id" type="string" required>
  Unique identifier for the Scanner tenant.
</ParamField>

<ParamField path="time_range_s" type="integer" required>
  Lookback period in seconds. Scanner requires minute granularity.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

<ParamField path="sync_key" type="string | null">
  Sync key used by automatic detection rule syncers.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  Tags to associate with the detection rule.

  Default: `null`.
</ParamField>

## Create Scanner event sink

Action ID: `tools.scanner.create_event_sink`

Create a Slack, webhook, or PagerDuty event sink in Scanner.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="description" type="string" required>
  Description of the event sink.
</ParamField>

<ParamField path="event_sink_args" type="object" required>
  API-native event sink configuration, such as \{"Webhook": \{"url": "[https://example.com/webhook"\&#125;\&#125](https://example.com/webhook"\&#125;\&#125);.
</ParamField>

<ParamField path="name" type="string" required>
  Name of the event sink.
</ParamField>

<ParamField path="tenant_id" type="string" required>
  Unique identifier for the Scanner tenant.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Delete Scanner detection rule

Action ID: `tools.scanner.delete_detection_rule`

Delete a Scanner detection rule by ID.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="detection_rule_id" type="string" required>
  Unique Scanner detection rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Delete Scanner event sink

Action ID: `tools.scanner.delete_event_sink`

Delete a Scanner event sink by ID.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="event_sink_id" type="string" required>
  Unique Scanner event sink ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Get Scanner detection rule

Action ID: `tools.scanner.get_detection_rule`

Get a Scanner detection rule by ID.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="detection_rule_id" type="string" required>
  Unique Scanner detection rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Get Scanner event sink

Action ID: `tools.scanner.get_event_sink`

Get a Scanner event sink by ID.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="event_sink_id" type="string" required>
  Unique Scanner event sink ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Get Scanner query progress

Action ID: `tools.scanner.get_query_progress`

Poll an asynchronous Scanner query for progress and results.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="query_run_id" type="string" required>
  Query run ID (`qr_id`) returned by `tools.scanner.start_query`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

<ParamField path="show_intermediate_results" type="boolean">
  Whether to return intermediate results while the query is running.

  Default: `true`.
</ParamField>

## List Scanner detection rules

Action ID: `tools.scanner.list_detection_rules`

List detection rules for a Scanner tenant.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="tenant_id" type="string" required>
  Unique identifier for the Scanner tenant.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

<ParamField path="page_size" type="integer | null">
  Maximum detection rules to return in a page. Scanner defaults to 50.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Pagination cursor returned as `next_page_token` by a previous request.

  Default: `null`.
</ParamField>

## List Scanner event sinks

Action ID: `tools.scanner.list_event_sinks`

List event sinks for a Scanner tenant.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="tenant_id" type="string" required>
  Unique identifier for the Scanner tenant.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Run Scanner detection YAML tests

Action ID: `tools.scanner.run_detection_rule_yaml_tests`

Run tests declared in a Scanner detection rule YAML document.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="yaml_text" type="string" required>
  Detection rule YAML content whose tests should be run.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Run Scanner query

Action ID: `tools.scanner.run_query`

Execute a blocking ad hoc query and return its results.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>
  Exclusive query end timestamp in RFC 3339 format.
</ParamField>

<ParamField path="query" type="string" required>
  Scanner query text to execute.
</ParamField>

<ParamField path="start_time" type="string" required>
  Inclusive query start timestamp in RFC 3339 format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

<ParamField path="max_bytes" type="integer | null">
  Maximum bytes for the result table. Scanner defaults to 134,217,728 bytes.

  Default: `null`.
</ParamField>

<ParamField path="max_rows" type="integer | null">
  Maximum rows to return. Scanner defaults to 1,000 and allows up to 100,000.

  Default: `null`.
</ParamField>

<ParamField path="scan_back_to_front" type="boolean | null">
  Scan from the latest events toward the earliest events.

  Default: `null`.
</ParamField>

<ParamField path="timeout_seconds" type="integer">
  HTTP timeout in seconds. Scanner may hold blocking queries open for up to 300 seconds.

  Default: `310`.
</ParamField>

## Start Scanner query

Action ID: `tools.scanner.start_query`

Start an asynchronous ad hoc query and return its query run ID.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>
  Exclusive query end timestamp in RFC 3339 format.
</ParamField>

<ParamField path="query" type="string" required>
  Scanner query text to execute.
</ParamField>

<ParamField path="start_time" type="string" required>
  Inclusive query start timestamp in RFC 3339 format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

<ParamField path="max_bytes" type="integer | null">
  Maximum bytes for the result table. Scanner defaults to 134,217,728 bytes.

  Default: `null`.
</ParamField>

<ParamField path="max_rows" type="integer | null">
  Maximum rows to return. Scanner defaults to 1,000 and allows up to 100,000.

  Default: `null`.
</ParamField>

<ParamField path="scan_back_to_front" type="boolean | null">
  Scan from the latest events toward the earliest events.

  Default: `null`.
</ParamField>

## Update Scanner detection rule

Action ID: `tools.scanner.update_detection_rule`

Update a Scanner detection rule with API-native fields.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="detection_rule_id" type="string" required>
  Unique Scanner detection rule ID.
</ParamField>

<ParamField path="updates" type="object" required>
  Detection rule fields to update. The rule ID is added to the request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Update Scanner event sink

Action ID: `tools.scanner.update_event_sink`

Update a Scanner event sink with API-native fields.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="event_sink_id" type="string" required>
  Unique Scanner event sink ID.
</ParamField>

<ParamField path="updates" type="object" required>
  Event sink fields to update. The event sink ID is added to the request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>

## Validate Scanner detection YAML

Action ID: `tools.scanner.validate_detection_rule_yaml`

Validate a Scanner detection rule YAML document.

Reference: [https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files)

### Secrets

Required secrets:

* `scanner`: required values `SCANNER_API_KEY`.

### Input fields

<ParamField path="yaml_text" type="string" required>
  Detection rule YAML content to validate.
</ParamField>

<ParamField path="base_url" type="string | null">
  Scanner team API URL. Falls back to `VARS.scanner.base_url`.

  Default: `null`.
</ParamField>