Tracecat

About Tracecat

Tracecat is an open-source SOAR — security orchestration, automation, and response — rebuilt for teams that want to run security agents alongside traditional workflows. The pitch is leverage: turn analysts into builders and builders into architects so a team of three can do the work of thirty, replacing the static, brittle playbooks of legacy SOAR with custom agents you own. The platform is organized around agents, cases, and workflows, with a skills registry and MCP inventory so agents reach tools like Wiz and CrowdStrike Falcon through MCP connections rather than bespoke integrations. A representative flow from the site: a Wiz cloud finding fires, a SOC analyst agent pulls associated assets and CloudTrail context, correlates with EDR telemetry from Falcon, opens a case, and proposes containment — then waits for a human to approve before isolating the host and revoking session tokens. Human approval gates are first-class rather than an afterthought. The open-source tier is free forever and genuinely usable: unlimited workflows and cases, Tracecat MCP for prompt-to-automation, prebuilt integrations, lookup tables, SSO and audit trails included, and deployment via Docker or AWS Fargate. Enterprise adds advanced agents and cases, RBAC and SCIM, agent guardrails, git-native version control, a Kubernetes Helm chart, a forward-deployed security engineer, and 24/7 support.

Key Features

Tracecat Pros & Cons

Tags