Tracecat Integration Expert

Tracecat Integration Expert

You are an expert at configuring and using Tracecat integrations with external security tools and services.

Integration Naming Convention

All integrations follow: tools..

Common Integrations

Threat Intelligence

| Integration | Actions | Secret Required | |------------|---------|-----------------| | VirusTotal | analyze_url, analyze_hash, get_report | virustotal (apikey) | | AbuseIPDB | check_ip, report_ip | abuseipdb (apikey) | | GreyNoise | check_ip, query | greynoise (apikey) | | Shodan | search, host_info | shodan (apikey) | | AlienVault OTX | get_indicators | otx (api_key) |

EDR / Endpoint

| Integration | Actions | Secret Required | |------------|---------|-----------------| | CrowdStrike | contain_host, lift_containment, search_detections | crowdstrike (clientid, clientsecret) | | SentinelOne | isolate_agent, get_threats | sentinelone (apikey, url) | | Microsoft Defender | isolate_machine, get_alerts | msdefender (tenantid, clientid, clientsecret) |

SIEM

| Integration | Actions | Secret Required | |------------|---------|-----------------| | Splunk | search, create_alert | splunk (token, url) | | Elastic | search, get_alerts | elastic (api_key, url) |

Communication

| Integration | Actions | Secret Required | |------------|---------|-----------------| | Slack | post_message, create_channel | slack (bottoken) | | PagerDuty | create_incident, acknowledge | pagerduty (apikey) | | Email (SMTP) | send_email | smtp (host, port, user, password) |

Identity

| Integration | Actions | Secret Required | |------------|---------|-----------------| | Okta | suspend_user, reset_password | okta (apikey, domain) | | Azure AD | disable_user, revoke_sessions | azuread (tenantid, clientid, clientsecret) |

Setting Up an Integration

1. Create the secret

Use tracecat_create_secret with:
  name: "virustotal"
  type: "custom"
  keys: [{ key: "api_key", value: "YOUR_API_KEY" }]

2. Use in workflow YAML

- ref: check_hash
  action: tools.virustotal.analyze_hash
  args:
    hash: ${{ TRIGGER.data.file_hash }}

The secret is automatically resolved by Tracecat based on the integration name.

Custom Integrations

For services without built-in integration, use core.http.request:

- ref: custom_api_call
  action: core.http.request
  args:
    method: POST
    url: https://api.example.com/v1/endpoint
    headers:
      Authorization: "Bearer ${{ SECRETS.custom_api.token }}"
      Content-Type: application/json
    payload:
      data: ${{ TRIGGER.data }}

Best Practices

1. Secret naming — Use the integration name as the secret name
2. Least privilege — Use API keys with minimum required permissions
3. Rate limiting — Add delays between bulk API calls
4. Error handling — Always handle API errors gracefully in workflows
5. Testing — Test integrations with non-destructive actions first

Related Skills

• tracecat-secrets-integrations — Detailed secret configuration and integration setup (replaces this skill for secrets)
• tracecat-action-configuration — Action types and input configuration
• tracecat-mcp-tools-expert — MCP tool reference for secrets and actions
• tracecat-workflow-patterns — Workflow design patterns using integrations
• tracecat-yaml-syntax — YAML syntax for integration inputs
• tracecat-validation-debug — Debug integration errors (HTTP 4xx/5xx)
• tracecat-code-python — Custom integrations via Python scripts

Reference Files

• [Common Mistakes](./COMMON_MISTAKES.md)
• [Examples](./EXAMPLES.md)
• [README](./README.md)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: adrojis
• Source: adrojis/tracecat-skills
• License: MIT

Install and usage instructions live in the source repository linked above.