Freedom251 › Malware Analysis Sandboxes
Hatching Triage
What Hatching Triage is
Hatching Triage is a malware sandbox for automated analysis of files and URLs. It supports analysis environments for Windows 7 and 10, Linux, Android, and macOS, and handles more than 100 file types and archives. After unpacking and static analysis, it selects a dynamic analysis environment. Users can watch detonation in real time and take control of the analysis virtual machine. Reports surface findings such as extracted configurations for a growing number of malware families. Profiles save settings including timeout and internet configuration and can select a custom virtual machine. A REST API provides access to analysis data and supports workflow automation; Hatching also documents a Cortex XSOAR integration for submitting samples, retrieving results, and managing accounts and profiles. Individual users and researchers can use the public cloud for free. Hatching says Triage can scale to 500,000 analyses per day, and offers a private-cloud demo environment on request. Its privacy policy says data is stored in the Netherlands and personal data is encrypted. Active-account data is retained indefinitely; after account deletion, submissions and reports remain while uploader-linking fields are deleted, and deleted data may remain in backups for up to 30 days.
Who it suits
It suits security service providers, MSSPs, SOAR companies, in-house SOCs, CERTs, and individual researchers analyzing suspicious files or URLs. The public cloud is free for individual users and researchers.
What it does well
- Analyzes more than 100 file types and archives.
- Supports Windows, Linux, Android, and macOS analysis.
- Users can monitor detonation and control the analysis VM.
- REST API supports analysis-data access and automation.
What to know first
- Active-account data is retained indefinitely.
- Submissions and reports remain after account deletion.
- Deleted data may remain in backups for up to 30 days.
Limits
Volume-based license packages start at 500 analyses per day and scale toward 50,000 per day, with bespoke enterprise volumes available. The free public cloud access has no stated quota in these facts.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Triage volume-based license | Packages start at 500 analyses per day and scale toward 50,000 per day; bespoke enterprise volumes available | On request |
As hatching.io lists them, read 29 Sept 2026. The maker's own page has the final word.
Getting started
- Open https://hatching.io/triage/
- Use the public cloud for free as an individual user or researcher
- Submit a file or URL for analysis
- Monitor detonation and review the resulting report
- Create profiles to save analysis settings or use the REST API to automate workflows
- Request a private cloud demo if evaluating a private deployment
Verdict
Triage combines automated sandbox analysis with live control, configurable profiles, reports, and API access. Individual users and researchers can use the public cloud for free, but should review the stated data-retention practices.
Questions
Is Hatching Triage free?
Individual users and researchers can use the public cloud for free. A volume-based license is also available.
What platforms does Triage analyze?
Analysis environments include Windows 7 and 10, Linux, Android, and macOS. The product is listed for Android, API, Linux, macOS, self-hosted, web, and Windows.
Does Triage have an API or integrations?
It offers a REST API for analysis data and workflow automation. Hatching documents a Cortex XSOAR integration for sample submission, result retrieval, and account and profile management.
How is Triage deployed?
Triage is available as a cloud service. Hatching offers a private cloud demo environment by request.
What does a volume-based license include?
Packages start at 500 analyses per day and scale toward 50,000 per day. Bespoke enterprise volumes are available; a price is not included in these facts.
Where is Hatching based?
Hatching was founded in 2018 and is headquartered near Amsterdam, Netherlands.
Facts from Hatching Triage's own pages
- API
- Triage offers a REST API for accessing analysis data and automating workflows. · hatching.io, 29 Sept 2026
- Data retention
- The privacy policy says active-account data is retained indefinitely; after account deletion, analysis submissions and reports remain while uploader-linking fields are deleted, and deleted data may remain in backups for up to 30 days. · hatching.io, 29 Sept 2026
- Founded
- 2018 · hatching.io, 28 Sept 2026
- Free access
- Individual users and researchers can use the public cloud for free; the page does not describe a time-limited trial. · hatching.io, 29 Sept 2026
- Headquarters
- Near Amsterdam, Netherlands · hatching.io, 28 Sept 2026
- Integrations
- Hatching documents a Cortex XSOAR integration that uses the Triage API to submit samples, fetch results, and perform account and profile management tasks. · hatching.io, 29 Sept 2026
- Intended users and support
- Hatching identifies security service providers, MSSPs, SOAR companies, in-house SOCs, and CERTs as users, and says customers speak directly with security specialists. · hatching.io, 29 Sept 2026
- Live analysis
- Users can monitor file detonation in real time and take control of the analysis virtual machine. · hatching.io, 29 Sept 2026
- Private deployment
- Hatching offers a private cloud demo environment that prospective customers can request. · hatching.io, 29 Sept 2026
- Product
- Hatching Triage is a malware sandbox for automated malware analysis. · hatching.io, 29 Sept 2026
- Profiles
- Profiles save analysis settings such as timeout and internet configuration, and can select a specific custom virtual machine. · hatching.io, 29 Sept 2026
- Reports
- Triage reports highlight relevant analysis results, including malware configurations extracted for a growing number of malware families. · hatching.io, 29 Sept 2026
- Scale
- Hatching says Triage can scale to 500,000 analyses per day. · hatching.io, 29 Sept 2026
- Security and data location
- Hatching's privacy policy says data is stored on servers in the Netherlands, stored personal data is encrypted, and physical locations follow ISO 27001 and SOC 2 requirements at a minimum. · hatching.io, 29 Sept 2026
- Submissions
- Triage supports more than 100 file types and archives, and automatically selects a dynamic analysis environment after unpacking and static analysis. · hatching.io, 29 Sept 2026
- Supported analysis platforms
- Triage supports analysis for Windows 7 and 10, Linux, Android, and macOS. · hatching.io, 29 Sept 2026
Where Hatching Triage stands on Freedom251
- Malware Analysis Sandboxes#4 of 27
- Sandbox Software#7 of 26