tracecat
by TracecatHQ
Tracecat is an open source, all-in-one automation platform providing workflows, tables, and case management for security and IT incident response.
All-in-one AI automation platform (workflows, agents, cases, tables) for security, IT, and production engineering teams.
Primary Use Case
Tracecat is designed for security and IT teams to automate incident response and case management workflows using simple YAML-based templates and a no-code UI. It serves as an alternative to platforms like Tines and Splunk SOAR, enabling orchestration of security operations at scale and reliability.
- Open source alternative to Tines and Splunk SOAR
- All-in-one platform with workflows, lookup tables, and case management
- Simple YAML-based integration templates with no-code UI
- Orchestration powered by Temporal for scalability and reliability
- Tracecat Registry with reusable integration and response-as-code templates
- Normalization of inputs using Open Cyber Security Schema (OCSF) ontology
- Multiple deployment options: Docker Compose, AWS Fargate, Kubernetes (coming soon)
- Active community support via Discord
Installation
- Deploy a local Tracecat stack using Docker Compose following instructions at https://docs.tracecat.com/self-hosting/deployment-options/docker-compose
- For production, deploy on AWS Fargate using Terraform as per https://docs.tracecat.com/self-hosting/deployment-options/aws-ecs
- Kubernetes deployment support is coming soon
Usage
>_ docker-compose upStart a local Tracecat stack using Docker Compose
>_ terraform applyDeploy a production-ready Tracecat stack on AWS Fargate using Terraform
- Integrate Tracecat with SIEMs and threat intelligence feeds to automate triage and enrichment workflows.
- Leverage the YAML-based no-code templates to rapidly prototype and deploy custom incident response playbooks.
- Use Tracecat Registry templates to standardize and share response actions across teams and environments.
- Deploy Tracecat in Kubernetes for scalable orchestration of complex multi-step investigations and remediation.
- Incorporate Tracecat into purple team exercises to simulate automated attacker behaviors and test detection and response.
Docs Take 2 Hours. AI Takes 10 Seconds.
Ask anything about tracecat. Installation? Config? Troubleshooting? Get answers trained on real docs and GitHub issues—not generic ChatGPT fluff.
3 free chats per tool • Instant responses • No credit card
Related Tools
mvt
mvt-project/mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
post-mortems
danluu/post-mortems
A collection of postmortems. Sorry for the delay in merging PRs!
Detect-It-Easy
horsicq/Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
howtheysre
upgundecha/howtheysre
A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)
awesome-incident-response
meirwah/awesome-incident-response
A curated list of tools for incident response
chainsaw
WithSecureLabs/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts