---
title: Quickstart
description: Learn Tracecat basics by building the classic VirusTotal enrichment playbook.
---

<Warning>
  If you haven't installed Tracecat yet, please check out our [self-hosting
  docs](/self-hosting/introduction) for step-by-step deployment instructions.
</Warning>

## Goals

By the end of this quickstart, you will learn how to:

- Create a new workflow
- Add secrets to your workspace
- Add an action to your workflow (e.g. search a URL with VirusTotal)
- Manually trigger the workflow

Let's get started!

## Prerequisites

- VirusTotal API key. You can obtain one for free from the [VirusTotal website](https://www.virustotal.com/gui/my-apikey).

## Tutorial

<Steps>
  <Step title="Log into Tracecat">
    <Note>
        The default admin user's email and password is configured on initial deployment.
        You can find out more about authentication in our [self-hosting docs](/self-hosting/authentication/introduction).
    </Note>
    ![Sign-in](/img/tutorials/quickstart/signin-page.png)
  </Step>
  <Step title="Create new workflow">
    ![Create new workflow](/img/tutorials/quickstart/create-new-workflow.png)
  </Step>
  <Step title="Rename workflow">
    Click onto the canvas to access workflow settings.
    Rename the workflow and save the changes by clicking on the save button.
    ![Rename workflow](/img/tutorials/quickstart/rename-workflow.png)
  </Step>
  <Step title="Add VirusTotal action">
    From the trigger action, search and select the VirusTotal **Search URL with VirusTotal** integration.
    ![Add new action](/img/tutorials/quickstart/add-vt-node.png)
  </Step>
  <Step title="Configure VirusTotal action inputs">
    <Tip>
        Tracecat comes with a powerful templating language called "expressions" and [JSONPath syntax](https://www.ietf.org/archive/id/draft-ietf-jsonpath-base-01.html) to reference results from upstream actions.

        Find out more about expressions in our [docs](/platform/expressions).
    </Tip>
    Pass data from the trigger into the VirusTotal action by filling in the inputs with the following expression:

    ```yaml
    url: ${{ TRIGGER.url }}
    ```

    ![Configure VirusTotal Search URL inputs](/img/tutorials/quickstart/configure-vt-inputs.png)

    Make sure to save the action inputs by clicking on the **Save** button at the top right of the action panel.
  </Step>
  <Step title="Add secret">
    Add your VirusTotal API key to workspace secrets.
    For the integration to work, you'll need to name the secret `virustotal` and assign your API token to a `VIRUSTOTAL_API_KEY` secret key.
    ![Secret settings](/img/tutorials/quickstart/credentials-setting.png)
    ![Create secret](/img/tutorials/quickstart/create-secret.png)

    <Note>
      Pre-built integrations in Tracecat come configured with a specific secret name and required keys.
      Find out how integrations and secrets work in our [docs](/platform/secrets).
    </Note>
  </Step>
  <Step title="Commit (AKA deploy) workflow">
    This saves a live version of your workflow.
    Workflows cannot be run until they are committed.
    ![Commit workflow](/img/tutorials/quickstart/commit-workflow.png)
  </Step>
  <Step title="Trigger workflow">
    Let's test this workflow with a JSON payload directly from the UI.
    For this demo, we use the following sample payload:
    ```json
    {"url": "https://crowdstrikebluescreen.com"}
    ```
    ![Trigger workflow](/img/tutorials/quickstart/trigger-workflow.png)
  </Step>
  <Step title="View workflow runs">
    You can monitor workflow runs and action outputs by switching to the **Runs** tab.
    ![View workflow runs](/img/tutorials/quickstart/view-runs.png)
  </Step>
  <Step title="Congratulations!">
    🎉 Congratulations on running your first security workflow in Tracecat!
  </Step>
</Steps>

## Next Steps

Learn how to use Tracecat's most powerful features in four self-paced tutorials:

- Define **if-conditions** in your workflows. View the [tutorial](/tutorials/2-control-flow).
- **Actions Registry** to manage integrations. View the [tutorial](/tutorials/3-actions-registry).
- **Secrets** to manage sensitive data for actions. View the [docs](/platform/secrets).

Check out the following cheatsheets for a list of Tracecat's integrations and utilities:

- **Expressions** to reference data in action inputs. View the [docs](/platform/expressions).
- **Prebuilt integrations** and their required secrets. View the [cheatsheet](/cheatsheets/integrations).
- **Functions** to manipulate data. View a list of available functions in the [cheatsheet](/cheatsheets/functions).
