[{"data":1,"prerenderedAt":432},["ShallowReactive",2],{"project-39819458":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":46,"post_text":48,"what":49,"said":96,"maker_in_thread":226,"shape":238,"grid":242,"attempts":394,"same_week":395,"maker_shows":33,"maker_hidden":424,"reader_version":425,"card":426},"39819458","Tracecat","Open-source security alert automation \u002F SOAR alternative","title","Show HN: Tracecat – Open-source security alert automation \u002F SOAR alternative","https:\u002F\u002Fgithub.com\u002FTracecatHQ\u002Ftracecat","github.com","neochris",1711389907,2024,264,65,276,3515,8,"legend","security_privacy","security orchestration and alert automation","web_app",[24,25,26,27],"soar","security alert automation","open source soar","incident response","curious",0.042,{"positive":31,"neutral":32,"mixed":33,"critical":34},5,19,1,10,35,{"idea":37,"execution":39,"privacy":42,"pricing":44,"docs":45},{"positive":38,"critical":33},4,{"positive":40,"critical":41},0,2,{"positive":40,"critical":43},6,{"positive":40,"critical":33},{"positive":33,"critical":40},[31,31,40,40,47,33,47,31,33,47,40,33,33,33,47,33,33,40,31,47,47,40,33,40,40,47,40,47,40,47,40,33,47,47,40,33,40,47,31,47],3,"Hi HN, we are building Tracecat (https:\u002F\u002Ftracecat.com\u002F), an open source automation platform for security alerts. Tracecat automates the tasks a security analyst has to do when responding to a security alert: e.g. contact victims, investigate security logs, report vulnerability.\n\nThe average security analyst deals with 100 alerts per day. As soon as an alert comes in, you have to investigate and respond. An average alert takes ~30 minutes to analyze (and 100 x 30 min = 50 hours > one whole day) Lots of things get dropped, and this creates vulnerabilities. Many breaches can be traced back to wee",{"problem":50,"audience":56,"pricing":60,"motivation":67,"time_to_build":71,"stack":72,"openness":93,"stage":94,"team_size":95},{"value":51,"source":52,"evidence":53},"Security analysts cannot investigate ~100 alerts a day; commercial SOAR tools are too expensive","maker",[54],{"id":55},"post",{"value":57,"source":52,"evidence":58},"Security teams, especially smaller ones priced out of enterprise SOAR",[59],{"id":55},{"value":61,"source":52,"evidence":62},"Self-host free under Apache-2.0; cloud version offered with no SSO tax",[63,64],{"id":55},{"id":65,"by":11,"text":66},"39821984","Cloud version. No SSO tax. We're doing a Show HN as we had strong conviction our message would resonate without the \"sticky\" Launch HN board. Looks like we were right!",{"value":68,"source":52,"evidence":69},"Founders saw security friends priced out of SOAR tools like Splunk SOAR",[70],{"id":55},null,[73,77,81,85,89],{"value":74,"source":52,"evidence":75},"Python 3.12 asyncio",[76],{"id":55},{"value":78,"source":52,"evidence":79},"SQLite",[80],{"id":55},{"value":82,"source":52,"evidence":83},"Tantivy",[84],{"id":55},{"value":86,"source":52,"evidence":87},"Pydantic V2",[88],{"id":55},{"value":90,"source":52,"evidence":91},"Zod",[92],{"id":55},"open_source","beta","team",{"praise":97,"objections":114,"requests":147,"questions":174,"alternatives":204},[98],{"value":99,"source":100,"evidence":101},"Cheaper open-source alternative to Splunk SOAR is welcome","commenter",[102,106,110],{"id":103,"by":104,"text":105},"39820020","toomuchtodo","Please put a stake in the heart of Palo Alto's XSOAR SOAR. Wishing you much success. Edit: Keep in mind, the folks who operate this are typically not engineers. They are security…",{"id":107,"by":108,"text":109},"39820727","francoismassot","This is awesome; we need this kind of alternative to overpriced software like Splunk. We built and open-sourced Quickwit to see this kind of tool built on top of it. We will…",{"id":111,"by":112,"text":113},"39824062","rosslazer","I don't know why so many people here are shitting on you guys. It is an impressive demo and launch and a wide-open market. I'm rooting for you, guys. There's an easy opening even…",[115,122,129,139],{"value":116,"source":100,"evidence":117},"Open source lacks support; security teams dislike self-hosting",[118],{"id":119,"by":120,"text":121},"39821286","badrabbit","Kudos on the effort for sure. Your biggest challenge is having good integrations for literally everything. Second big challenge: companies that will use open source are a rarity.…",{"value":123,"source":100,"evidence":124},"Target market and buyer understanding questioned; ITSM teams may be the buyer",[125],{"id":126,"by":127,"text":128},"39821676","tomashertus","These are exciting times in the cybersecurity industry with the recent growth of open-source security tools (osquery, Fleet, Wazuh, etc.). Anyway, I'm skeptical about the…",{"value":130,"source":100,"evidence":131},"Security posture of a startup selling security tools is a concern",[132,136],{"id":133,"by":134,"text":135},"39822512","dogman144","You’re not measuring against Splunk, you should be measuring against Tines. And tines is def broader than fortune 10, they sell the heck out to startups, so I think you’ve got…",{"id":137,"by":134,"text":138},"39899080","This was how Lastpass was exploited +\u002F- details, lot of write-ups on this. Devops eng ran a personal unpatched Plex server, threat actor came in via home network\u002Fplex, pivoted to…",{"value":140,"source":100,"evidence":141},"Integrations are lacking",[142,143],{"id":119,"by":120,"text":121},{"id":144,"by":145,"text":146},"39819797","ThaDood","Neat! Another FOSS SOAR platform. Quick read through built-in integrations. Any support for Elastic both SIEM and EDR? And do you all have like an MSP program? Assuming not, but…",[148,155,160,164],{"value":149,"source":100,"evidence":150},"Add integrations with Elastic, CrowdStrike and Microsoft Defender",[151,152],{"id":144,"by":145,"text":146},{"id":153,"by":11,"text":154},"39820094","Will post an updated demo with the output and share it here later today! But here is what one response looks like: \"Thank you for your report. the AI labelled this email as…",{"value":156,"source":100,"evidence":157},"Add case management and ticketing integration",[158,159],{"id":119,"by":120,"text":121},{"id":126,"by":127,"text":128},{"value":161,"source":100,"evidence":162},"Move feedback off Discord",[163],{"id":144,"by":145,"text":146},{"value":165,"source":100,"evidence":166},"Fix UI issues such as deleting nodes and lag",[167,171],{"id":168,"by":169,"text":170},"39824641","Nathanba","I couldn't find a way to delete nodes after I placed some. It also seemed laggy in the sense that when I drag and dropped a node from the left to the scene it took 2-3 seconds at…",{"id":172,"by":169,"text":173},"39824736","Oh ok that works, for some reason that didn't even occur to me. I kept trying to press the Delete key.",[175,186,190,197],{"value":176,"source":100,"evidence":177},"What is the business model and pricing?",[178,182],{"id":179,"by":180,"text":181},"39820000","yevpats","Congrats! What is the business model? Also, I see that the license is permissive which is great but how do you protect yourself from other companies hosting your solution and…",{"id":183,"by":184,"text":185},"39821638","leetrout","What is your plan for monetization with this? Open source core with the hosted platform being paid? Or specific features being paid? Any price ranges in mind? I am tired of all…",{"value":187,"source":100,"evidence":188},"How will the project protect against competing hosted forks?",[189],{"id":179,"by":180,"text":181},{"value":191,"source":100,"evidence":192},"Is there an MSP program?",[193,194],{"id":144,"by":145,"text":146},{"id":195,"by":11,"text":196},"39819997","As for the MSP program, absolutely 100% yes. Would love to hear your use-case \u002F pain points regarding existing SOARs (both oss and close sourced). Shuffle is the OG of FOSS…",{"value":198,"source":100,"evidence":199},"What security program does the team run?",[200,201],{"id":133,"by":134,"text":135},{"id":202,"by":134,"text":203},"39854159","I wouldn’t recommend panther or a SIEM for small startups. D&R is a bit less important for startups beyond some python scripts piping in the boilerplate alerts via API that…",[205,210,214,222],{"value":206,"source":100,"evidence":207},"Splunk SOAR",[208,209],{"id":103,"by":104,"text":105},{"id":119,"by":120,"text":121},{"value":211,"source":100,"evidence":212},"Palo Alto XSOAR",[213],{"id":103,"by":104,"text":105},{"value":215,"source":100,"evidence":216},"Tines",[217,218],{"id":133,"by":134,"text":135},{"id":219,"by":220,"text":221},"39821266","1as","(I work at Tines) We're flattered by the mention & imitation ;-) But seriously, congrats on shipping, and for bringing some new ideas into the fold. One point of clarification:…",{"value":223,"source":52,"evidence":224},"Shuffle",[225],{"id":195,"by":11,"text":196},{"comments":227,"answered":18,"key":228},18,[229,232,235],{"id":230,"text":231},"39820205","Save time and money. That's what we are here for. Any thoughts on our analysis regarding case management and log storage? These are two technical decisions we made before writing…",{"id":233,"text":234},"39820382","Glad to hear we are on the right track. Tracecat is still in alpha, but would be great to have your thoughts \u002F opinions \u002F feedback in our Discord community. We are anon-friendly.…",{"id":236,"text":237},"39828263","Thanks for the comment Ross. Folks seem to have strong opinions about integrating or separating workflows and ticketing ala alert inbox. We like integrations a lot, but of course…",{"commenters":239,"max_depth":18,"maker_replies":227,"first_comment_mins":240,"lifespan_hours":241},23,33,340,[243,245,247,250,252,256,258,260,263,265,268,271,272,273,276,279,281,283,285,287,289,291,293,295,297,299,303,305,307,309,310,312,314,315,317,319,320,323,325,327,329,330,335,337,339,340,342,343,346,349,352,354,357,359,362,363,365,368,370,374,376,381,383,388,390],[103,40,31,244,104,40],"project\u002Fpositive\u002Fidea",[230,40,40,246,11,33],"maker\u002Fneutral\u002Fidea",[248,40,31,249,104,40],"39820258","maker\u002Fpositive\u002Fidea",[233,40,40,251,11,33],"maker\u002Fneutral\u002Fnone",[253,40,40,254,255,40],"39820945","commenter\u002Fneutral\u002Fnone","kjs3",[257,40,40,254,104,40],"39820986",[259,40,47,246,255,40],"39841410",[261,40,47,262,120,40],"39821299","project\u002Fneutral\u002Fnone",[119,33,33,264,120,40],"project\u002Fcritical\u002Fexecution",[266,33,47,251,267,40],"39821411","daryllimyt",[269,33,47,270,120,40],"39823558","project\u002Fneutral\u002Fidea",[111,41,31,244,112,40],[236,41,40,251,11,33],[274,41,33,275,134,40],"39830399","maker\u002Fcritical\u002Fprivacy",[277,41,40,278,11,33],"39836041","maker\u002Fneutral\u002Fprivacy",[280,41,47,278,134,40],"39853974",[282,41,40,254,11,33],"39857266",[133,47,33,284,134,40],"project\u002Fcritical\u002Fprivacy",[286,47,40,251,11,33],"39822916",[288,47,33,275,134,40],"39822945",[290,47,40,278,11,33],"39822958",[292,47,33,275,134,40],"39823057",[294,47,47,278,134,40],"39823124",[296,47,40,278,11,33],"39823255",[298,47,33,275,134,40],"39830047",[300,47,40,301,302,40],"39841731","other\u002Fneutral\u002Fnone","0x4e53",[126,38,33,304,127,40],"project\u002Fcritical\u002Fidea",[306,38,40,254,11,33],"39822087",[308,38,40,254,127,40],"39847532",[107,31,31,244,108,40],[311,31,47,251,267,40],"39821619",[183,43,47,313,184,40],"project\u002Fneutral\u002Fpricing",[65,43,40,313,11,33],[316,43,47,278,134,40],"39822559",[318,43,40,278,11,33],"39836034",[202,43,33,275,134,40],[321,43,40,322,11,33],"39857242","commenter\u002Fneutral\u002Fprivacy",[324,43,40,322,134,40],"39899107",[326,43,40,251,11,33],"39974263",[328,43,40,322,11,33],"39858198",[137,43,40,322,134,40],[331,332,47,333,334,40],"39820500",7,"project\u002Fmixed\u002Fidea","xyst",[336,332,40,301,255,40],"39820772",[338,332,47,246,267,40],"39820839",[144,18,47,262,145,40],[341,18,40,251,11,33],"39819951",[195,18,40,251,11,33],[344,18,47,270,345,40],"39820261","windexh8er",[347,18,40,301,348,40],"39824506","lmeyerov",[350,18,40,301,351,40],"39831768","mavam",[168,353,33,264,169,40],9,[355,353,47,356,267,40],"39824653","maker\u002Fneutral\u002Fexecution",[172,353,47,358,169,40],"project\u002Fneutral\u002Fexecution",[360,353,47,361,267,40],"39825873","maker\u002Fneutral\u002Fdocs",[179,34,47,313,180,40],[364,34,40,246,11,33],"39820079",[366,34,33,367,180,40],"39823484","project\u002Fcritical\u002Fpricing",[219,369,40,301,220,40],11,[371,369,40,372,373,40],"39821990","other\u002Fneutral\u002Fdocs","mdaniel",[375,369,40,301,220,40],"39827482",[377,378,47,379,380,40],"39819950",12,"project\u002Fneutral\u002Fdocs","catkitcourt",[153,378,40,382,11,33],"project\u002Fpositive\u002Fperformance",[384,385,31,386,387,40],"39821275",13,"project\u002Fpositive\u002Fdocs","justusthane",[389,385,47,361,267,40],"39821307",[391,392,47,270,393,40],"39827609",14,"BD103",[],[396,401,406,411,416,420],{"id":397,"name":398,"points":399,"category":400},"39783223","Memories",797,"productivity",{"id":402,"name":403,"points":404,"category":405},"39778570","Dropflow",404,"dev_tools",{"id":407,"name":408,"points":409,"category":410},"39836630","Explanations",391,"learning_science",{"id":412,"name":413,"points":414,"category":415},"39807912","Glossarie",363,"languages",{"id":417,"name":418,"points":419,"category":405},"39816836","Jampack",328,{"id":421,"name":422,"points":423,"category":405},"39793513","magick.css",305,false,"v2",{"id":427,"name":5,"line":6,"ai":424,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":428,"top":18,"kw":429,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":430,"url":9,"mix":431,"praise":99,"objection":116,"sub":21},39819458,0.04,[24,25,26,27],"5500313513011131105330100303030133010353",[31,32,33,34],1794036651836]