Automate alert triage and threat hunts
Check endpoint detections, look for beaconing in network logs, and investigate suspicious sign-ins. Each prompt helps you choose the schedule, evidence sources, and escalation criteria.
Tools for continuous monitoring
MCP servers for the tools used in these examples.
Automation examples and starter prompts
Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.
Triage CrowdStrike detections
Build me a detection triage automation in Tracecat. Pull new CrowdStrike detections, mark them in progress, and check each process hash against VirusTotal. Open a Jira ticket per confirmed detection and post a summary to Slack. First help me understand how this maps to DE.CM-09 and what good continuous monitoring looks like. Ask me which Jira project and Slack channel to use. Talk me through whether this works better as a scheduled workflow or an agent.
Hunt for beaconing in network logs
Build me a scheduled threat hunt in Tracecat. Query Splunk every morning for outbound connections that repeat on a fixed interval, score each source host by interval regularity and destination rarity, and check the top destinations against GreyNoise. Open a case for anything that looks like command and control and post the daily summary to Slack. First help me understand how this maps to DE.CM-01 and how beaconing shows up in network logs. Ask me which index my network logs live in and what schedule fits my team. Talk me through tuning the scoring before we automate it.
Watch sign-ins and risky consent grants
Build me an automation in Tracecat that monitors sign-in activity and OAuth consent grants in Microsoft Entra ID. Flag new high-privilege grants, impossible travel, and sign-ins from unmanaged devices. Open a case per flagged user with the evidence attached and notify the IAM team in Slack. First help me understand how this maps to DE.CM-03 and where monitoring personnel activity crosses into privacy territory I should be careful with. Ask me which signals matter most in my environment. Talk me through whether this should run as a scheduled workflow or an agent that reviews each sign-in alert.
Monitor external service providers
Build me a vendor monitoring automation in Tracecat. Watch my SaaS providers' audit logs for new admin accounts, API keys, and permission changes, and track vendor breach disclosures from threat intel feeds. Open a case when a provider shows unusual activity and tag it with the affected vendor. First help me understand how this maps to DE.CM-06 and what external service provider monitoring usually misses. Ask me which providers carry the most risk for us. Talk me through what I can realistically monitor with the API access I have.
Detect software and config drift
Build me a drift detection automation in Tracecat. Compare the software inventory from Jamf against my approved list every week, flag unapproved installs and disabled security agents, and check runtime config changes in Datadog. Open a ServiceNow ticket per host that drifts and post a weekly summary to Slack. First help me understand how this maps to DE.CM-09 and why runtime monitoring matters beyond inventory. Ask me where my approved software list lives. Talk me through how strict the enforcement should be before we automate ticketing.
NIST CSF 2.0 mapping: DE.CM
Official NIST category: Continuous Monitoring. Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events
The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.
- DE.CM-01AC-2AU-12CA-7CM-3SC-5SC-7SI-4
Networks and network services are monitored to find potentially adverse events
- Monitor DNS, BGP, and other network services for adverse events
- Monitor wired and wireless networks for connections from unauthorized endpoints
- Monitor facilities for unauthorized or rogue wireless networks
- Compare actual network flows against baselines to detect deviations
- Monitor network communications to identify changes in security postures for zero trust purposes
- DE.CM-02CA-7PE-3PE-6PE-20
The physical environment is monitored to find potentially adverse events
- Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts
- Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)
- Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering
- Monitor the physical environment using alarm systems, cameras, and security guards
- DE.CM-03AC-2AU-12AU-13CA-7CM-10CM-11
Personnel activity and technology usage are monitored to find potentially adverse events
- Use behavior analytics software to detect anomalous user activity to mitigate insider threats
- Monitor logs from logical access control systems to find unusual access patterns and failed access attempts
- Continuously monitor deception technology, including user accounts, for any usage
- DE.CM-06CA-7PS-7SA-4SA-9SI-4
External service provider activities and services are monitored to find potentially adverse events
- Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems
- Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior
- DE.CM-09AC-4AC-9AU-12CA-7CM-3CM-6CM-10CM-11SC-34SC-35SI-4SI-7
Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
- Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events
- Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse
- Monitor software configurations for deviations from security baselines
- Monitor hardware and software for signs of tampering
- Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized
Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.
Build your own security automation
Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.