Tracecat Integration Expert
You are an expert at configuring and using Tracecat integrations with external security tools and services.
Integration Naming Convention
All integrations follow: tools.<integration>.<action>
Common Integrations
Threat Intelligence
| Integration |
Actions |
Secret Required |
| VirusTotal |
analyze_url, analyze_hash, get_report |
virustotal (api_key) |
| AbuseIPDB |
check_ip, report_ip |
abuseipdb (api_key) |
| GreyNoise |
check_ip, query |
greynoise (api_key) |
| Shodan |
search, host_info |
shodan (api_key) |
| AlienVault OTX |
get_indicators |
otx (api_key) |
EDR / Endpoint
| Integration |
Actions |
Secret Required |
| CrowdStrike |
contain_host, lift_containment, search_detections |
crowdstrike (client_id, client_secret) |
| SentinelOne |
isolate_agent, get_threats |
sentinelone (api_key, url) |
| Microsoft Defender |
isolate_machine, get_alerts |
msdefender (tenant_id, client_id, client_secret) |
SIEM
| Integration |
Actions |
Secret Required |
| Splunk |
search, create_alert |
splunk (token, url) |
| Elastic |
search, get_alerts |
elastic (api_key, url) |
Communication
| Integration |
Actions |
Secret Required |
| Slack |
post_message, create_channel |
slack (bot_token) |
| PagerDuty |
create_incident, acknowledge |
pagerduty (api_key) |
| Email (SMTP) |
send_email |
smtp (host, port, user, password) |
Identity
| Integration |
Actions |
Secret Required |
| Okta |
suspend_user, reset_password |
okta (api_key, domain) |
| Azure AD |
disable_user, revoke_sessions |
azuread (tenant_id, client_id, client_secret) |
Setting Up an Integration
1. Create the secret
Use tracecat_create_secret with:
name: "virustotal"
type: "custom"
keys: [{ key: "api_key", value: "YOUR_API_KEY" }]
2. Use in workflow YAML
- ref: check_hash
action: tools.virustotal.analyze_hash
args:
hash: ${{ TRIGGER.data.file_hash }}
The secret is automatically resolved by Tracecat based on the integration name.
Custom Integrations
For services without built-in integration, use core.http.request:
- ref: custom_api_call
action: core.http.request
args:
method: POST
url: https://api.example.com/v1/endpoint
headers:
Authorization: "Bearer ${{ SECRETS.custom_api.token }}"
Content-Type: application/json
payload:
data: ${{ TRIGGER.data }}
Best Practices
- Secret naming — Use the integration name as the secret name
- Least privilege — Use API keys with minimum required permissions
- Rate limiting — Add delays between bulk API calls
- Error handling — Always handle API errors gracefully in workflows
- Testing — Test integrations with non-destructive actions first
Related Skills
- tracecat-secrets-integrations — Detailed secret configuration and integration setup (replaces this skill for secrets)
- tracecat-action-configuration — Action types and input configuration
- tracecat-mcp-tools-expert — MCP tool reference for secrets and actions
- tracecat-workflow-patterns — Workflow design patterns using integrations
- tracecat-yaml-syntax — YAML syntax for integration inputs
- tracecat-validation-debug — Debug integration errors (HTTP 4xx/5xx)
- tracecat-code-python — Custom integrations via Python scripts
Reference Files
1---2name: tracecat-integration-expert3description: Activate when users configure external tool integrations (VirusTotal, CrowdStrike, Slack, Splunk, etc.) in Tracecat workflows4---56# Tracecat Integration Expert78You are an expert at configuring and using Tracecat integrations with external security tools and services.910## Integration Naming Convention1112All integrations follow: `tools.<integration>.<action>`1314## Common Integrations1516### Threat Intelligence17| Integration | Actions | Secret Required |18|------------|---------|-----------------|19| VirusTotal | `analyze_url`, `analyze_hash`, `get_report` | `virustotal` (api_key) |20| AbuseIPDB | `check_ip`, `report_ip` | `abuseipdb` (api_key) |21| GreyNoise | `check_ip`, `query` | `greynoise` (api_key) |22| Shodan | `search`, `host_info` | `shodan` (api_key) |23| AlienVault OTX | `get_indicators` | `otx` (api_key) |2425### EDR / Endpoint26| Integration | Actions | Secret Required |27|------------|---------|-----------------|28| CrowdStrike | `contain_host`, `lift_containment`, `search_detections` | `crowdstrike` (client_id, client_secret) |29| SentinelOne | `isolate_agent`, `get_threats` | `sentinelone` (api_key, url) |30| Microsoft Defender | `isolate_machine`, `get_alerts` | `msdefender` (tenant_id, client_id, client_secret) |3132### SIEM33| Integration | Actions | Secret Required |34|------------|---------|-----------------|35| Splunk | `search`, `create_alert` | `splunk` (token, url) |36| Elastic | `search`, `get_alerts` | `elastic` (api_key, url) |3738### Communication39| Integration | Actions | Secret Required |40|------------|---------|-----------------|41| Slack | `post_message`, `create_channel` | `slack` (bot_token) |42| PagerDuty | `create_incident`, `acknowledge` | `pagerduty` (api_key) |43| Email (SMTP) | `send_email` | `smtp` (host, port, user, password) |4445### Identity46| Integration | Actions | Secret Required |47|------------|---------|-----------------|48| Okta | `suspend_user`, `reset_password` | `okta` (api_key, domain) |49| Azure AD | `disable_user`, `revoke_sessions` | `azuread` (tenant_id, client_id, client_secret) |5051## Setting Up an Integration5253### 1. Create the secret54```55Use tracecat_create_secret with:56 name: "virustotal"57 type: "custom"58 keys: [{ key: "api_key", value: "YOUR_API_KEY" }]59```6061### 2. Use in workflow YAML62```yaml63- ref: check_hash64 action: tools.virustotal.analyze_hash65 args:66 hash: ${{ TRIGGER.data.file_hash }}67```6869The secret is automatically resolved by Tracecat based on the integration name.7071## Custom Integrations7273For services without built-in integration, use `core.http.request`:7475```yaml76- ref: custom_api_call77 action: core.http.request78 args:79 method: POST80 url: https://api.example.com/v1/endpoint81 headers:82 Authorization: "Bearer ${{ SECRETS.custom_api.token }}"83 Content-Type: application/json84 payload:85 data: ${{ TRIGGER.data }}86```8788## Best Practices89901. **Secret naming** — Use the integration name as the secret name912. **Least privilege** — Use API keys with minimum required permissions923. **Rate limiting** — Add delays between bulk API calls934. **Error handling** — Always handle API errors gracefully in workflows945. **Testing** — Test integrations with non-destructive actions first9596## Related Skills97- **tracecat-secrets-integrations** — Detailed secret configuration and integration setup (replaces this skill for secrets)98- **tracecat-action-configuration** — Action types and input configuration99- **tracecat-mcp-tools-expert** — MCP tool reference for secrets and actions100- **tracecat-workflow-patterns** — Workflow design patterns using integrations101- **tracecat-yaml-syntax** — YAML syntax for integration inputs102- **tracecat-validation-debug** — Debug integration errors (HTTP 4xx/5xx)103- **tracecat-code-python** — Custom integrations via Python scripts104105## Reference Files106- [Common Mistakes](./COMMON_MISTAKES.md)107- [Examples](./EXAMPLES.md)108- [README](./README.md)
adrojis