Open-source security automation (SOAR) platform for building AI agent-driven workflows, for security teams replacing legacy SOAR tools.
What it does
Tracecat is a security automation platform that lets teams build workflows and AI agents to triage alerts, enrich findings, and take response actions across their security stack. It is open source and self-hostable for free, with an Enterprise edition adding advanced agent, case, and compliance features.
Core features
Workflow builder with loops, conditionals, and parallel subflows
AI agents that triage alerts and propose response actions with human approval gates
Prebuilt integrations across SIEM, EDR, MDM, and identity tools
Hosted MCP server catalog for connecting coding assistants
Case management with comments, attachments, and linked tables
Audit logging of every prompt, tool call, and decision
Best for
→Automating phishing email triage and containment
→Enriching and prioritizing cloud security findings
→Isolating compromised endpoints via EDR integration
→Reviewing and revoking risky OAuth application grants
Pricing
Open Source
Free