Tracecat, an open-source SOAR platform for security engineers, is actively evolving with a focus on user experience improvements and expanded integration capabilities. The project, designed to simplify security workflows through no-code and configuration-as-code methodologies, has seen significant development activity over the past month.
Recent issues and pull requests indicate a proactive phase in Tracecat's development, emphasizing user experience and integration enhancements. Issues such as #307 highlight efforts to improve error messaging, while feature requests like #300 and #287 suggest expanding integration capabilities. The development team, comprising Daryl Lim, Chris Lo, Matt Durant, Xander Luedtke, Kevin Robertson, and R0psteev, has been actively contributing through various commits and PRs. Notable activities include:
| Developer | Avatar | Branches | PRs | Commits | Files | Changes |
|---|---|---|---|---|---|---|
| Daryl Lim |  |
3 | 24/23/3 | 35 | 169 | 19451 |
| Chris Lo |  |
4 | 10/10/1 | 95 | 260 | 14737 |
| Matt |  |
1 | 14/12/2 | 12 | 18 | 1378 |
| LuedTek |  |
1 | 2/2/0 | 2 | 2 | 60 |
| r0psteev |  |
1 | 1/1/0 | 1 | 2 | 6 |
| Kevin Robertson |  |
1 | 2/1/1 | 1 | 1 | 3 |
| Christian Clauss (cclauss) | 0 | 1/0/0 | 0 | 0 | 0 | |
| Jason Ostrom (iknowjason) | 0 | 1/0/0 | 0 | 0 | 0 |
PRs: created by that dev and opened/merged/closed-unmerged during the period
| Timespan | Opened | Closed | Comments | Labeled | Milestones |
|---|---|---|---|---|---|
| 7 Days | 1 | 0 | 1 | 0 | 1 |
| 30 Days | 8 | 2 | 29 | 1 | 1 |
| 90 Days | 12 | 21 | 40 | 2 | 1 |
| All Time | 80 | 68 | - | - | - |
Like all software activity quantification, these numbers are imperfect but sometimes useful. Comments, Labels, and Milestones refer to those issues opened in the timespan in question.
The Tracecat project has recently seen a surge in activity, with 12 open issues currently being tracked. Notably, the issues span a range of enhancements and feature requests, indicating a proactive development phase focused on user experience and integration capabilities. A significant theme is the emphasis on improving error messaging and user guidance, as evidenced by Issue #307, which seeks to enhance the clarity of error messages for end users.
Several issues reflect ongoing discussions about integration capabilities, particularly with CrowdStrike (Issue #300) and remote integrations (Issue #287). This suggests that the community is actively engaged in expanding the platform's functionality to meet diverse user needs. However, there are also critical issues related to user authentication and workflow execution that remain unresolved, highlighting potential areas of concern for new users.
Issue #307: [TRACKER] More useful error messages
Issue #300: [FEATURE REQUEST] Crowdstrike - Allow member CIDs to be specified in API calls
Issue #287: [FEATURE IDEA] Remote integrations ie decouple integrations registration from core code
Issue #271: [FEATURE IDEA] Multi-client integrations within same workflow
Issue #268: [FEATURE IDEA] Workspaces to separate credentials / variables / workflows
Issue #287: [FEATURE IDEA] Remote integrations ie decouple integrations registration from core code
Issue #271: [FEATURE IDEA] Multi-client integrations within same workflow
Issue #268: [FEATURE IDEA] Workspaces to separate credentials / variables / workflows
Issue #300: [FEATURE REQUEST] Crowdstrike - Allow member CIDs to be specified in API calls
Issue #307: [TRACKER] More useful error messages
Overall, the current issue landscape reflects both a vibrant community engagement and critical areas that require attention to ensure a smooth user experience as Tracecat continues to evolve.
The analysis of the pull requests (PRs) for the Tracecat project reveals a diverse range of enhancements, bug fixes, and feature implementations aimed at improving the platform's functionality, integration capabilities, and user experience. The PRs reflect ongoing efforts to refine the codebase, address community feedback, and expand the tool's capabilities in security orchestration and automation.
PR #306: Run tests on Python 3.13 release candidate
Created 5 days ago; aims to update testing workflows to support Python 3.13. Currently blocked by an issue with the greenlet library.
PR #304: Implement DB migrations with alembic
Created 8 days ago; introduces Alembic for database migrations, enhancing database management capabilities.
PR #299: Terraform deployment for ECS Fargate
Created 11 days ago; proposes a comprehensive Terraform setup for deploying Tracecat on AWS ECS Fargate, streamlining cloud deployments.
PR #209: Add workflow concurrency stress tests
Created 55 days ago; focuses on adding performance testing workflows to benchmark system behavior under stress conditions.
PR #315: Add env-migration script
Merged recently; provides a script to help users migrate their .env configurations safely.
PR #314: Set user role to basic on create
Not merged; intended to enforce user role restrictions during account creation.
PR #313: Implement change email and password
Merged; allows users to update their email and password through the UI.
PR #312: Evaluate expressions on non-loop child workflow path
Merged; fixes expression evaluation issues in child workflows.
PR #311: Revamp docs for 0.7.0
Merged; updates documentation to reflect recent changes and improve clarity.
PR #310: Make ExprEvaluator not strict by default
Merged; adjusts expression evaluation behavior for better usability.
PR #309: Allow object/attribute access for JSONPath
Merged; enhances JSONPath functionality within the platform.
PR #305: Docker network hardening & volume cleanup
Merged; improves security and organization of Docker networking configurations.
PR #303: Add "_enabled" to docker-compose.yml SMTP envs
Merged; aligns environment variable naming conventions for SMTP settings.
PR #302: Add Tracecat workspaces
Merged; introduces workspaces as a core feature, enhancing user organization capabilities.
The pull requests submitted to the Tracecat repository demonstrate several key themes and trends that reflect both ongoing development priorities and community engagement:
A significant number of PRs focus on adding new features that enhance user experience and expand the platform's capabilities. For instance, PR #304 introduces Alembic for database migrations, which is crucial for maintaining schema changes over time without data loss. Similarly, PR #302 adds workspaces, allowing users to better organize their projects within Tracecat. This reflects a growing emphasis on usability and user-centric design in response to community feedback.
Several PRs aim at improving integration with external services and deployment processes. The Terraform deployment for ECS Fargate (PR #299) exemplifies this trend by simplifying cloud deployments, which is critical for users looking to leverage AWS infrastructure efficiently. Additionally, PRs related to SMTP enhancements (PR #259) and LDAP integrations (PR #293) indicate a strong focus on expanding Tracecat's interoperability with other tools commonly used in security operations.
Numerous PRs are dedicated to addressing bugs and technical debt within the codebase. For example, PR #312 resolves expression evaluation issues in workflows, while PR #305 focuses on Docker networking hardening—both crucial for ensuring system reliability and security. The attention given to fixing existing issues demonstrates a commitment to maintaining a robust platform that can handle real-world use cases effectively.
The revamping of documentation (PR #311) highlights an important aspect of open-source projects—clear communication with users. By updating installation guides and usage instructions, the maintainers are ensuring that both new and existing users can navigate the platform effectively. Furthermore, community involvement is evident in discussions around PRs where contributors actively seek feedback from peers before merging changes, fostering a collaborative development environment.
While many PRs have been successfully merged or are progressing well, some notable challenges include blocked PRs like #306 due to dependencies on external libraries (e.g., greenlet). This highlights potential bottlenecks in development that could delay feature rollouts or bug fixes if not addressed promptly.
In conclusion, the ongoing development efforts reflected in these pull requests indicate a vibrant community dedicated to enhancing Tracecat's functionality while ensuring stability and usability. The balance between adding new features, improving integrations, addressing bugs, and maintaining clear documentation is essential for the project's continued success as an open-source SOAR platform.
Daryl Lim (daryllimyt)
Chris Lo (topher-lo)
Matt Durant (mattdurant)
Xander Luedtke (LuedTek)
Kevin Robertson (acumen-kevinr)
R0psteev (r0psteev)
Summary
Quantified Reports
Detailed Reportsenv-migration.sh).docker-compose.yml and tracecat/__init__.py.The development team is actively engaged in enhancing the Tracecat platform with a balanced approach between feature development, bug fixing, and documentation improvements. The collaborative efforts among team members indicate a cohesive working environment focused on delivering robust solutions for security automation.