Open source security automation platform for teams and AI agents
Tracecat helps AI-native security teams build agents and automate work.
Wiz alert
wiz.finding.created
SOC analyst agent
Wiz MCP · Falcon MCP
Isolate host
falcon.isolate_host
Triage this Wiz finding: privilege escalation on a prod IAM role.
• Pull associated assets and CloudTrail context via Wiz MCP
• Correlate with EDR telemetry from Falcon MCP
I can route this through the SOC analyst agent — it will tune the finding into an actionable case, correlate EDR telemetry, and propose containment.
Yes — open a case and prepare containment.
Wiz (MCP connected)
CrowdStrike Falcon (MCP connected)Found Isolate host in Falcon. It will quarantine the endpoint and revoke active session tokens while you review.
Ready to run Isolate host on i-0a7f…. Approve to proceed.
Trusted by security builders replacing legacy SOAR
Turn ideas into secure agentic workflows through chat.
Learn about Automations Copilot in Tracecat →200+ integrations across SIEM, EDR, CNAPP, and IdP — Splunk, Sentinel, Falcon, Wiz, Okta, Google Workspace, Entra.
MCP-native: Wiz, Falcon, Splunk, Sentinel, GitHub API, and any LLM. All sandboxed.
Run loops, if-conditions, parallel subflows, and scripts (Python, Bash, Javascript).
Run agents in workflows with explicit tool approvals.
Trigger
New OAuth consent
Scatter
Split by user
Close alert
Allowlisted app
OAuth analyst agent
AI Agent
Revoke Google grant
Revoke Entra grant
Notify ownerRun subflow
Account quarantine
Work alongside agents built by your team.
Learn about Cases in Tracecat →Shai-Hulud npm worm — @ctrl/tinycolor exposure across 3 endpoints
Internal advisory flagged @ctrl/tinycolor@4.1.2 as compromised by the Shai-Hulud worm. A GitHub API search found references in 7 repos. CrowdStrike Falcon flagged the npm install and post-install script execution on 3 developer workstations.
Detection details
- GitHub advisory ingested at 14:08 UTC, Falcon detection at 14:42 UTC
- 34-minute detection delay
- Initial exposure via transitive dependency in package-lock.json
Indicators of compromise
- Malicious package: @ctrl/tinycolor@4.1.2
- Post-install SHA: a1f2c3…d4e5
- C2 callback: webhook.site/<redacted>
- Affected endpoints: WS-042, WS-118, WS-203
Recommended actions: pin affected repos to clean versions, rotate npm + GitHub PAT tokens, isolate affected endpoints in Falcon, and audit GitHub Actions runners for token reuse.
Summary drafted from the case description.
Suggested next steps
- Pin clean versions across 7 affected repos
- Rotate npm and GitHub PAT tokens org-wide
- Isolate WS-042, WS-118, WS-203 via Falcon
I can draft a containment runbook and pre-fill actions from the IOC list — token rotation, endpoint isolation, and repo owner notifications.
Build your security workforce with agents.
Learn about Agents in Tracecat →Incident response agent
Wiz (CNAPP)Falcon (EDR)Goal
Triage and tune cloud alerts into actionable findings, then draft an IR runbook with containment steps.
Instructions
1. Pull related alerts from SIEM, EDR, and CNAPP.
2. Correlate with CloudTrail and identity logs.
3. Draft an IR runbook with containment and rollback steps.
Looks like Shai-Hulud exposure. Recommend isolating WS-042 in Falcon and auditing the 7 repos that reference @ctrl/tinycolor.
- Quarantine WS-042 via Falcon
- Block outbound traffic to known C2 domains
Drafting now. I'll also pull endpoint inventory from MDM to find any other exposed hosts.
- Create CASE-234967 with full IOC list
- Rotate npm + GitHub PAT tokens via GitHub API
Tables
Tracecat is mission ready.
Learn about the Enterprise Edition →Build for free
Sign up to Tracecat
By signing up, you accept our Terms of Use and confirm that you have taken note of our Privacy Policy.
Loved by security teams building with AI
Security Engineer @ Depop
Tracecat copilot has changed my life. I can finally create the workflows I've been envisioning and turn ideas into reality. I never had enough time to build and experiment around my other responsibilities. Now I can ask Tracecat copilot to whip something up, then spend my time iterating until it's right.
Senior Security Engineer @ Neo Financial
A genuine thank you to the team. I built an end-to-end IoC enrichment pipeline with Claude and Tracecat MCP and created more value for our SOC in a day than I probably would have in weeks on my own. You're making my one-man SOC assignment possible.
Principal Threat Researcher @ Saronic
Tracecat is a cheat code for corporate security teams that want to build and own their own agentic future.