Open source security automation platform for teams and AI agents
Tracecat helps security teams build agents and automate work.
Isolate Gmail account from Slack request
nowInvestigate Q4 metrics
2mHandle IT request
5mCustomer: API rate limits
15mDraft weekly report
1hTrigger
Slack request
Lookup Gmail account
gmail.find_user
Isolate Gmail account
gmail.isolate
Isolate Gmail account given Slack request
• What Slack signal should trigger the workflow?
• Which Gmail account fields are required for isolation?
I can wire this to a Slack request and then isolate the matching Gmail account. Which Slack request type should trigger this?
Security request: Isolate Gmail account
Slack (OAuth connected)
Gmail (OAuth connected)I found a single action for this request: Isolate Gmail account. It will disable the account and revoke active sessions.
Ready to add the Isolate Gmail account action to your workflow.
Trusted by security builders in mission-critical environments
Turn security ideas into scalable, auditable automations through chat.
Learn about Automations in Tracecat →Over 200 connectors for security, IT, and infrastructure tools.
All actions and agents are run in a sandbox, isolated from secrets.
Run loops, if-conditions, parallel subflows, and scripts (Python, Bash, Javascript).
Run agents in workflows with explicit tool approvals.
Trigger
SaaS drift alert
Scatter
Split by account
Close alert
No drift found
IAM analyst agent
AI Agent
Isolate userIsolate deviceNotify ownerRun subflow
Access quarantine
Work alongside agents built by your team.
Learn about Cases in Tracecat →Phishing attack with successful credential compromise - marketing department user
Employee sarah.chen@company.com reported a suspicious email impersonating IT requesting a password verification. The phishing email compromised corporate credentials and enabled lateral movement attempts.
Detection details
- User report at 09:42 UTC, gateway alert at 12:15 UTC
- 2.5 hour detection delay
- Initial access via spoofed domain email link
Indicators of compromise
- Sender: itsupport@company-verify.net
- Reply-to: support.verify@protonmail.com
- Login IP: 185.220.101.45 (Tor exit node)
Recommended actions: reset credentials, revoke sessions, and run targeted mailbox audit for related phishing campaigns.
Summary drafted from the case description.
Suggested next steps
- Disable compromised IAM and corporate email accounts
- Run mailbox search for the spoofed sender
- Check for lateral movement attempts
I can generate a timeline and pre-fill containment actions based on the IOC list.
Build your security workforce with agents.
Learn about Agents in Tracecat →Incident response agent
Goal
Triage security alerts, enrich with context, and recommend containment steps.
Instructions
1. Pull related alerts from SIEM and on-call logs.
2. Correlate with auth and network telemetry.
3. Propose containment and rollback steps.
I recommend pausing the rollout and checking the new cache invalidation path.
- Compare latency before/after release `v2.7.1`
- Inspect DB connection pool saturation
Drafting now. I’ll also pull the last successful deploy notes and summarize impact.
- Rollback to `v2.7.0` in us-east-1
- Verify error budget burn rate normalization
Tables
Tracecat is mission ready.
Learn about the Enterprise Edition →Build for free
Sign up to Tracecat
By signing up, you accept our Terms of Use and confirm that you have taken note of our Privacy Policy.
Loved by security teams building with AI
Security engineer @ Depop
Tracecat copilot has changed my life. I can finally create the workflows I've been envisioning and turn ideas into reality. I never had enough time to build and experiment around my other responsibilities. Now I can ask Tracecat copilot to whip something up, then spend my time iterating until it's right.
Dirk, Security lead @ Neo Financial
A genuine thank you to the team. I built an end-to-end IoC enrichment pipeline with Claude and Tracecat MCP and created more value for our SOC in a day than I probably would have in weeks on my own. You're making my one-man SOC assignment possible.
Security lead @ Saronic
Tracecat is a cheat code for corporate security teams that want to build and own their own agentic future.