---
title: "Functions"
description: "Inline utility functions for Tracecat expressions: transform strings, dates, numbers, lists, and JSON inside workflow and agent definitions."
---

## Overview

Tracecat expressions can call built-in functions with the `FN.<name>(...)` syntax.
Function results support bracket indexing such as `FN.range(0, 3)[0]`.
Function results do not support JSONPath wildcards or filters such as `FN.range(0, 3)[*]`.

Use in-line functions for one-line data transforms in action inputs.
For more complex logic, use a Python script or a custom UDF instead.

## Examples

Build a prompt or short string:

<CodeGroup>
```yaml Expression
prompt: ${{ FN.format("Investigate alert {0} with severity {1}", TRIGGER.alert_id, TRIGGER.severity) }}
```

```json Result
{
  "prompt": "Investigate alert al-123 with severity high"
}
```
</CodeGroup>

Time manipulation for alert search windows:

<CodeGroup>
```yaml Expression
start_time: ${{ FN.to_isoformat(FN.now() - FN.minutes(15)) }}
end_time: ${{ FN.to_isoformat(FN.now()) }}
```

```json Result
{
  "start_time": "2026-03-18T12:45:00",
  "end_time": "2026-03-18T13:00:00"
}
```
</CodeGroup>

## Related pages

- See the [Functions cheatsheet](/cheatsheets/functions) for the full function reference and more examples.
- See [Expressions](/automations/core-concepts/expressions) for expression syntax and contexts.
