tracecat-platform-guide

name

tracecat-platform-guide

description

REQUIRED whenever the user asks what Tracecat is, what it can do, how to do something in the product, or where to find a feature in the UI — e.g. "how do I add a secret", "where are my integrations", "what's the difference between a case and a workflow", "can Tracecat send Slack messages", "how do I schedule a workflow", "set up an OAuth integration". Read this SKILL.md FIRST when orienting a user, explaining a concept, or directing them to a page. It covers the platform mental model, what the product offers, where each feature lives in the UI, and the core concepts (secrets vs variables vs expressions). For building/editing workflows, use tracecat-manage-workflows instead.

Tracecat platform guide

Use this to orient users, explain what Tracecat does, and direct them to the right place in the UI. Stay accurate: when you don't know a detail, say so or point the user to the page rather than inventing steps.

What Tracecat is

Tracecat is a security automation platform where AI agents and humans triage and investigate threats. The primitives:

• Workflows — automations built as a graph of actions. Started by a trigger (webhook, schedule, case event, manual run). Data flows through expressions (${{ ... }}).
• Actions — the building blocks inside a workflow: HTTP calls, transforms, Python scripts, case operations, AI steps, and tools.* integrations (Slack, Jira, etc.).
• Cases — persistent investigation records. Teams add comments, evidence/attachments, tasks, and custom fields. Workflows create and enrich cases over time.
• Tables — structured data rows (assets, allowlists, indicators) that workflows insert into and look up across runs.
• Agents — AI tool-callers. They run inside a workflow (ai.agent) or as saved presets with their own instructions, tools, and MCP servers.