- Home
- Malware Analysis Sandboxes
- ThreatLab
On the recordRead 7 Oct 202614 facts
ThreatLab
Plans and prices
Team
$84a month
3+ seats · Unlimited sessions · All features included · 15% volume discount
Read 7 Oct 2026 · threatlabsandbox.com
Starter
$99a month
1–2 seats · Unlimited sessions · All features included
Read 7 Oct 2026 · threatlabsandbox.com
On the record
- AI integrations
- Users can provide API keys from Anthropic, OpenAI, or Google for AI analysis; the page says keys are encrypted locally with AES-256-CBC.threatlabsandbox.com · read 7 Oct 2026
- Data handling
- The maker says samples are not uploaded and analysis runs locally on the user's hardware.threatlabsandbox.com · read 7 Oct 2026
- Event log analysis
- The built-in EVTX analyzer includes 2,900+ Sigma rules and supports timeline views, severity filtering, and CSV or JSON export.threatlabsandbox.com · read 7 Oct 2026
- Interactive analysis
- Its isolated Hyper-V sessions provide live desktop control, file and URL analysis, session recording, and save and resume.threatlabsandbox.com · read 7 Oct 2026
- Maker
- The site identifies the maker as BrightByte Labs LLC.threatlabsandbox.com · read 7 Oct 2026
- Management and support
- A web management portal handles licenses, seat allocation, machine tracking, downloads, and documentation; the app also has issue reporting with optional log attachment.threatlabsandbox.com · read 7 Oct 2026
- Monitoring
- Sysmon monitoring captures process, network, file system, and registry events in real time.threatlabsandbox.com · read 7 Oct 2026
- Purpose
- ThreatLab is a local malware analysis sandbox for security teams, with analysis running on hardware they control.threatlabsandbox.com · read 7 Oct 2026
- Reporting
- It generates PDF reports with executive summaries, indicators of compromise, severity distribution, and technical details, with custom branding.threatlabsandbox.com · read 7 Oct 2026
- Seat limits
- A seat is one machine activation, and the maker says plans above 10 seats require contacting it for custom pricing.threatlabsandbox.com · read 7 Oct 2026
- System requirements
- The maker lists Windows 10/11 Pro or Enterprise 64-bit with Hyper-V, at least 16 GB RAM, 4 or more CPU threads with virtualization support, and 50 GB free disk space.threatlabsandbox.com · read 7 Oct 2026
- Threat detection
- The product includes DLL injection, credential access, scheduled task, service, ransomware canary, and certificate store monitoring.threatlabsandbox.com · read 7 Oct 2026
- Trial
- The maker offers a 30-day trial with full feature access and no credit card required; it says the license arrives by email within 12 hours.threatlabsandbox.com · read 7 Oct 2026
- VPN
- ThreatLab offers WireGuard VPN exit nodes in the US, UK, Germany, and Spain, with a kill switch that blocks internet access if the tunnel drops.threatlabsandbox.com · read 7 Oct 2026
