Open Source Cortex XSOAR Alternatives
A curated collection of the 1 best open source alternatives to Cortex XSOAR.
The best open source alternative to Cortex XSOAR is Tracecat. If that doesn't suit you, we've compiled a ranked list of other open source Cortex XSOAR alternatives to help you find a suitable replacement.
Cortex XSOAR alternatives are mainly Threat Detection & Response. Browse these if you want a narrower list of alternatives or looking for a specific functionality of Cortex XSOAR.
Open source security automation platform combining agents, workflows, lookup tables and case management for security teams that prefer writing Python.
Security teams end up with automation scattered across ad hoc scripts, a SOAR license and a ticket queue. Tracecat puts agents, workflows, lookup tables and case management in one product, and lets custom Python scripts sync from your own Git repository to become agent tools and workflow steps.
Execution is sandboxed by default with nsjail, and workflows run on Temporal, so a long-running automation survives restarts and retries instead of dying halfway. The backend is Python with FastAPI, SQLAlchemy and Pydantic, the frontend is Next.js, state lives in PostgreSQL and objects go to any S3-compatible store.
The open source edition covers most of the day job.
- Agents: custom agents assembled from prompts, tools and chat.
- Workflows: a low-code builder with conditionals, loops and durable execution.
- Integrations: over a hundred prebuilt connectors speaking HTTP, SMTP, gRPC and OAuth.
- MCP in both directions: prompts become automations through your coding agent, and custom agents connect out to any MCP server.
- No SSO tax: SAML and OIDC are included, with audit logs exportable into your SIEM.
Deployment runs through Docker, AWS Fargate or a Kubernetes Helm chart, with managed cloud as the alternative. The repository is AGPL v3 apart from the enterprise directory, which needs a paid license in production and adds fine-grained access control, human-in-the-loop approval of sensitive tool calls and workspace version control. Development moves quickly, so read the changelog before updating.
