Tracecat: Open-source SOAR
Tracecat is an open-source automation platform for security teams. The developers believe security automation should be accessible to everyone, especially understaffed small- to mid-sized teams. Core features, user interfaces, and day-to-day workflows are based on existing best practices from best-in-class security teams.
Use specialized AI models to label, summarize, and enrich alerts. Contextualize alerts with internal evidence and external threat intel:
- Find cases using semantic search
- MITRE ATT&CK labels
- Whitelist / blacklist identities
- Categorize related cases
- MITRE D3FEND suggestions
- Upload evidence and threat intel
Tracecat is not a 1-to-1 mapping of Tines / Splunk SOAR. The developers aim to give technical teams a Tines-like experience but with a focus on open-source and AI features.
While Tracecat is designed for security, its workflow automation and case management system are also suitable for various alerting environments, such as site reliability engineering, DevOps, and physical systems monitoring.
Turn security alerts into solvable cases:
- Click-and-drag workflow builder – Automate SecOps using pre-built actions (API calls, webhooks, data transforms, AI tasks, and more) combined into workflows. No code required.
- Built-in case management system – Open cases direct from workflows. Track and manage security incidents all-in-one platform.
Tracecat is cloud-agnostic and deploys anywhere that supports Docker. It’s available for free on GitHub.
Must read:
- 15 open-source cybersecurity tools you’ll wish you’d known earlier
- 20 essential open-source cybersecurity tools that save you time