Hatching Triage is a malware sandbox for automated analysis of files and URLs. It supports analysis environments for Windows 7 and 10, Linux, Android, and macOS, and handles more than 100 file types and archives. After unpacking and static analysis, it selects a dynamic analysis environment. Users can watch detonation in real time and take control of the analysis virtual machine. Reports surface findings such as extracted configurations for a growing number of malware families. Profiles save settings including timeout and internet configuration and can select a custom virtual machine. A REST API provides access to analysis data and supports workflow automation; Hatching also documents a Cortex XSOAR integration for submitting samples, retrieving results, and managing accounts and profiles. Individual users and researchers can use the public cloud for free. Hatching says Triage can scale to 500,000 analyses per day, and offers a private-cloud demo environment on request. Its privacy policy says data is stored in the Netherlands and personal data is encrypted. Active-account data is retained indefinitely; after account deletion, submissions and reports remain while uploader-linking fields are deleted, and deleted data may remain in backups for up to 30 days.
Who it is for
It suits security service providers, MSSPs, SOAR companies, in-house SOCs, CERTs, and individual researchers analyzing suspicious files or URLs. The public cloud is free for individual users and researchers.
What is good
- Analyzes more than 100 file types and archives.
- Supports Windows, Linux, Android, and macOS analysis.
- Users can monitor detonation and control the analysis VM.
- REST API supports analysis-data access and automation.
What to know first
- Active-account data is retained indefinitely.
- Submissions and reports remain after account deletion.
- Deleted data may remain in backups for up to 30 days.
Verdict
Triage combines automated sandbox analysis with live control, configurable profiles, reports, and API access. Individual users and researchers can use the public cloud for free, but should review the stated data-retention practices.
Hatching Triage plans and pricing
All plansCompared on malware analysis sandboxes
- Free plan
- Yes
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
- Deployment model
- cloud
