Tracecat is an open-source, AI-native SOAR platform that automates security workflows.

Who should use Tracecat?

It is best for security analysts, IT teams, and security operations centers.

Yes, the core software is open-source and free to self-host forever.

How is Tracecat priced?

Self-hosting is free, while the managed Enterprise plan has custom, sales-led pricing.

Does Tracecat support custom APIs?

Yes, it provides over 100 connectors and allows custom integration via MCP.

What should buyers check first?

Review the self-hosted Docker instructions if you plan to run Tracecat locally.

Tracecat

Name: Tracecat
Brand: Tracecat

Open-source AI-native security automation and SOAR platform.

Visit Website

What is Tracecat?

TL;DR

Tracecat is an open-source AI-native security orchestration and automation platform for building incident workflows and security agents. It helps SOC teams automate investigation, enrichment, response, and approval-driven actions.

AI-native playbook builder that generates workflows from text instructions
Prebuilt connectors for Okta, Wiz, CrowdStrike, and Slack APIs
Sandboxed execution using nsjail for processing untrusted code

Explore with AI

About

Tracecat is an open-source, AI-native Security Orchestration, Automation, and Response (SOAR) platform designed to help security teams build agents and automate incident workflows. By utilizing natural language, security operators can describe tasks such as "verify and triage this phishing email," and the system uses AI to generate, execute, and refine security playbooks. It serves as a modern alternative to legacy SOAR products. The product is useful for security analysts, IT managers, and security operations center (SOC) teams looking to reduce alert fatigue. By using Tracecat, teams can integrate with third-party security platforms like CrowdStrike, Okta, and Wiz, allowing agents to collect indicators of compromise (IoCs) and quarantine threats. It automates repetitive security checks and triages tickets. A main difference is Tracecat's focus on agentic security workflows rather than visual logic loops. The platform features an integrated Model Context Protocol (MCP) server, allowing agents to execute security actions, lookup database records, and query allowlists. The core platform is open-source and free to self-host, while enterprise editions include compliance, SCIM, and approval gates. For FutureStack, Tracecat belongs in AI Agents because its core function is running automated, intelligent agents to manage security operations. It is best for security teams and operations managers looking for open-source, AI-native automation tools. It is not for organizations seeking general IT helpdesk systems or simple network firewalls.

Use Cases

Security Incident Triage

Automate repetitive investigation steps such as collecting indicators, enriching alerts, and preparing cases for analysts.

Security Agent Workflows

Build AI-assisted agents that can execute security playbooks, reason over findings, and coordinate multiple response steps.

SOAR Automation

Connect security products and operational tools to automate recurring workflows across alerts, cases, and response actions.

Controlled Security Actions

Use approvals, policies, and audit trails to keep sensitive automated security actions under explicit operational control.

Key Features

AI-native playbook builder that generates workflows from text instructions
Prebuilt connectors for Okta, Wiz, CrowdStrike, and Slack APIs
Sandboxed execution using nsjail for processing untrusted code
Enterprise approval gates to control sensitive agent actions

Featured Tools

Wispr Flow

Voice-First Dictation

We may earn commissions from links to support our work. Learn more.