Tracecat
Tracecat: A developer-focused SOAR combining AI agents, playbooks, cases, and open-source deployment. Ranked #11 of 22 in SOAR Software by our editors (8.3/10); pricing: Free plan; best for developers wanting open-source AI-assisted SOAR.
At a glance
- Editor score8.3 / 10
- PricingFree plan
- Best forDevelopers wanting open-source AI-assisted SOAR
- Free planYes
- Playbook automationYes
- Founded2024 · New York City, New York, United States
- Facts checked20 Sep 2026
Where it wins
- Unlimited workflows, cases, and agents in the Open Source plan
- AI agents, Python actions, approvals, and Git-based prompt versioning
- Integrates with major security, cloud, identity, and observability tools
Where it doesn't
- Enterprise pricing is custom rather than listed
- Advanced RBAC, SCIM, and 24/7 support require Enterprise
- Founded in 2024, with less maturity evidence than established SOAR products
Our verdict on Tracecat
Tracecat is an open-source security orchestration, automation, and response platform for security teams and developers. It combines AI agents with deterministic workflows, security case management, alert triage, enrichment, threat-intelligence actions, audit logs, and MCP-based access to security and IT tools. Teams can deploy it through the web, API, or self-hosted environments, using workflows for investigation, threat hunting, vulnerability response, and incident response. Its positioning suits organizations that want an AI-assisted SOAR foundation with control over deployment and automation logic.
The Open Source plan provides unlimited workflows, cases, and agents, along with agent presets and skills, a hosted MCP server catalog, prebuilt integrations, lookup tables, and deployment through Docker or AWS Fargate. The platform also includes human approval gates, run history, Git synchronization, prompt versioning, and custom Python actions in a sandbox. Enterprise adds cloud or self-hosted deployment, RBAC, service accounts, SCIM, advanced cases, a Kubernetes Helm chart, tool approvals with a unified inbox, and 24/7 Slack and email support. Enterprise pricing is custom, so organizations evaluating paid deployment will need a direct commercial discussion.
Tracecat’s ecosystem spans Elastic, Panther, Splunk, Microsoft Sentinel, Google Cloud SecOps, CrowdStrike Falcon, SentinelOne, Jamf, Microsoft Defender XDR, Wiz, AWS, Microsoft Entra ID, and Okta. Its hosted MCP catalog lists 56 integrations, while the documentation also includes additional native integrations. That breadth supports teams connecting detection, cloud, endpoint, identity, and case workflows in one automation layer. Choose Tracecat if open-source deployment, AI-assisted playbooks, and developer control are priorities. Teams seeking a longer-established product or fully specified Enterprise pricing may prefer an alternative.
Your product? Our editors can test Tracecat in depth and publish a review, labelled as paid · from $149/mo →
Tracecat pricing
All 2 Tracecat plans and prices →
Tracecat fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Playbook automation | Yes |
| Alert enrichment | Yes |
| Threat intel actions | Yes |
| Case management | Yes |
| Deployment model | Not verified |
| Published integrations | 56 |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Compliance & security | SOC 2 |
| Support | Email, Live chat, Community, Docs · 24/7 |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 56+ integrations: Elastic, Panther, Splunk, Microsoft Sentinel, RunReveal, Google Cloud SecOps … See all → |
| Pricing | Free plan (source) |
| Website | tracecat.com |
| Facts checked | 20 Sep 2026 |
Tracecat integrations
Tracecat lists 56+ integrations on its own site — the 20 named here are the ones its pages call out.
- Elastic
- Panther
- Splunk
- Microsoft Sentinel
- RunReveal
- Google Cloud SecOps
- Sumo Logic
- CrowdStrike Falcon
- SentinelOne
- Jamf
- Microsoft Defender XDR
- Wiz
- AWS
- Microsoft Entra ID
- Okta
- HashiCorp Vault
- Cloudflare
- Zscaler
- Palo Alto Networks
- Semgrep
See all Tracecat integrations →
Alternatives to Tracecat
- Cortex XSOARA case-driven SOAR platform for enterprise security operations teams.9.3
- ShuffleA value-focused SOAR platform for teams that want open-source and self-hosted options.9.2
- Splunk SOARA strong-value SOAR platform with broad automation, case management and a free edition.9.1
See all Tracecat alternatives →
Also Ranked In
Tracecat is ranked in 3 of our directories.
Used Tracecat? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Tracecat for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Tracecat is listed in our SOAR Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/tracecat/"><img src="https://www.itechguides.com/best/badge/tracecat.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update