Hatching Triage

Hatching Triage is a cloud-based malware sandbox for automated analysis of suspicious files and URLs. It supports analysis environments for Windows 7 and 10, Linux, Android, and macOS, and handles more than 100 file types and archives. After unpacking and static analysis, it selects a dynamic analysis environment. Users can monitor file detonation live and take control of the analysis virtual machine. Reports highlight relevant findings, including configurations extracted for a growing number of malware families. Profiles save settings such as timeout and internet configuration, and can specify a custom virtual machine. A REST API provides access to analysis data and supports workflow automation; Hatching also documents a Cortex XSOAR integration for sample submissions, result retrieval, and account and profile tasks. Individual users and researchers can use the public cloud for free. Hatching offers a private cloud demo environment on request and says Triage can scale to 500,000 analyses per day. Its privacy policy says data is stored on servers in the Netherlands and personal data is encrypted. Active-account data is retained indefinitely; after account deletion, submissions and reports remain, while uploader-linking fields are deleted. Deleted data may remain in backups for up to 30 days.

Triage combines multi-platform sandbox analysis, live control, reporting, profiles, and API-based automation. Consider its stated data-retention practices when deciding whether to submit files.

Triage suits security service providers, MSSPs, in-house SOCs, SOAR companies, and CERTs that need automated sample analysis and API access. Individual users and researchers can also use its public cloud for free.

Overview

Hatching Triage is an automated malware-analysis sandbox aimed at researchers and security teams that need to inspect suspicious files across several operating systems. Its public cloud is free for individual users and researchers, while organizations can buy capacity by daily analysis volume. It is a strong fit for repeatable analysis workflows, but cloud users should consider how long submissions and reports remain stored.

Key features

Triage accepts more than 100 file types and archives, unpacks submissions, performs static analysis, then selects a dynamic-analysis environment. That can cut setup work when handling varied samples. It supports Windows 7 and 10, Linux, Android, and macOS; that breadth is useful for malware with different target environments, though it does not mean every operating system is available as a listed platform for every deployment.

Analysts can watch a file detonate in real time and take control of the analysis virtual machine. Reports emphasize relevant results, including configurations extracted for a growing number of malware families. Profiles preserve settings such as timeout and internet configuration, and can select a custom virtual machine. Together, these features favor teams that need to repeat or adjust investigations rather than simply receive a pass-or-fail result.

The REST API exposes analysis data and supports workflow automation. Hatching documents a Cortex XSOAR integration for sample submission, result retrieval, and account and profile management. That makes Triage a more natural fit for SOC and SOAR pipelines than a stand-alone file-checking tool. Hatching says the service can scale to 500,000 analyses per day, while commercial packages start at 500 daily analyses and extend toward 50,000, with bespoke enterprise volumes available.

Pricing

Public cloud: Free for individual users and researchers. There is no stated time-limited trial; this access is useful for personal investigation, but it is not presented as an organizational license.

Triage volume-based license: Custom pricing. Packages start at 500 analyses per day and scale toward 50,000 per day, with bespoke enterprise volumes available. This model suits teams that can estimate ongoing throughput, but readers should match their expected volume to the package before committing. Hatching also offers a private-cloud demo environment that prospective customers can request.

Platforms

Triage is offered through the cloud and supports analysis of Windows 7 and 10, Linux, Android, and macOS samples. The product's broader platform coverage includes web, API, and self-hosted alongside Android, Linux, macOS, and Windows. API access, URL analysis, network-traffic analysis, and IOC extraction support workflows that extend beyond uploading a file for a report.

Who it's for

Hatching identifies security service providers, MSSPs, SOAR companies, in-house SOCs, and CERTs as its audiences. Researchers and individual users can start on the free public cloud; teams that need steady analysis volume, custom profiles, or API-driven handling are better matched to a paid license. Hatching says customers speak directly with security specialists, which is relevant for organizations building the service into an operational workflow.

Data is stored on servers in the Netherlands, and stored personal data is encrypted. Physical locations follow ISO 27001 and SOC 2 requirements at a minimum. The retention terms deserve attention for sensitive samples: data tied to an active account is retained indefinitely. After account deletion, analysis submissions and reports remain, although uploader-linking fields are deleted; deleted data may also persist in backups for up to 30 days. Organizations with strict deletion requirements should resolve that fit before submitting material.

Pros and cons

• Broad automated analysis: More than 100 file types and four operating-system families reduce the need to prepare a separate environment for every sample.
• Useful analyst controls: Live VM control and configurable profiles support investigations that require intervention or repeatable settings.
• Automation-ready: A REST API and documented Cortex XSOAR integration can connect analysis to existing response workflows.
• Retention may not suit sensitive work: Active-account data remains indefinitely, and submissions and reports persist after account deletion.
• Commercial costs require volume planning: Organizational licensing is volume-based with custom pricing, so teams need to establish expected daily throughput before evaluating fit.

Alternatives

Sandbox Software and Malware Analysis Sandboxes are useful starting points for comparing the broader categories.

ANY.RUN is a close alternative for readers who want a freemium sandbox with a free Community plan, a free trial, and listed analysis environments including Windows, Android, and Ubuntu. Choose it when those stated plan terms and environments better match your evaluation needs.

CodeSandbox is a different choice for browser-based development sandboxes, with Build and Scale plans describing member counts and monthly VM credits. It is not the same malware-analysis focus as Triage.

Zscaler Private Access is a paid private-access product rather than a malware-analysis sandbox, so consider it when private access is the requirement.

Anthropic Sandbox Runtime is a free, self-hostable option across Linux, macOS, and Windows for readers seeking a different kind of sandbox.

Context Agent Sandboxes offers a free tier and a $20 a month Plus plan for agent sandboxes; consider it when that is the workflow you need.

crun is a free Linux and self-hosted OCI container runtime, not a malware-analysis service.

Docker Desktop is a freemium desktop container option with a free Personal plan and a $9 a month Pro plan; choose it for container development rather than malware detonation.

E2B offers a freemium, Apache-2.0-licensed runtime that can be self-hosted. Consider it when an open-source, self-hostable runtime matters more than Triage's stated malware-analysis workflow.

Verdict

Choose Hatching Triage if you are a security researcher, SOC, CERT, MSSP, or SOAR team that needs automated multi-platform malware analysis with live control, profiles, and API workflows. Its main advantage is the combination of automated environment selection and operational integration; its main drawback is retention of submissions and reports, including after account deletion. If that policy conflicts with your handling requirements, resolve it first or choose a workflow with terms that fit them better.