Skip to content
SPECIFICTION
Get listed

Hatching Triage

hatching.io

WebWindowsmacOSLinuxAndroidAPI
Visit hatching.io
Spec score 7.6 #10 of 27 in Malware Analysis Sandboxes

What it is

Hatching Triage is a malware sandbox for automated analysis of files and URLs. It supports Windows 7 and 10, Linux, Android, and macOS analysis environments, and accepts more than 100 file types and archives. After unpacking and static analysis, it chooses a dynamic environment for detonation. Users can watch the analysis live and take control of its virtual machine. Reports surface relevant results, including extracted configurations for a growing number of malware families. Profiles preserve settings such as timeouts and internet configuration, and can specify a custom virtual machine. A REST API supports access to analysis data and workflow automation; a documented Cortex XSOAR integration can submit samples, retrieve results, and manage accounts and profiles. Individual users and researchers can use the public cloud for free. Hatching offers a private cloud demo on request, and says Triage can scale to 500,000 analyses per day. Its privacy policy says data is stored in the Netherlands and personal data is encrypted. Active-account data is retained indefinitely; after account deletion, submissions and reports remain, while uploader-linking fields are removed. Deleted data may remain in backups for up to 30 days.

Spec sheet

Product
Hatching Triage is a malware sandbox for automated malware analysis.Read 29 Sep 2026 · hatching.io
API
Triage offers a REST API for accessing analysis data and automating workflows.Read 29 Sep 2026 · hatching.io
Integrations
Hatching documents a Cortex XSOAR integration that uses the Triage API to submit samples, fetch results, and perform account and profile management tasks.Read 29 Sep 2026 · hatching.io
Headquarters
Near Amsterdam, NetherlandsRead 28 Sep 2026 · hatching.io
Founded
2018Read 28 Sep 2026 · hatching.io
Data retention
The privacy policy says active-account data is retained indefinitely; after account deletion, analysis submissions and reports remain while uploader-linking fields are deleted, and deleted data may remain in backups for up to 30 days.Read 29 Sep 2026 · hatching.io
Free access
Individual users and researchers can use the public cloud for free; the page does not describe a time-limited trial.Read 29 Sep 2026 · hatching.io
Intended users and support
Hatching identifies security service providers, MSSPs, SOAR companies, in-house SOCs, and CERTs as users, and says customers speak directly with security specialists.Read 29 Sep 2026 · hatching.io
Live analysis
Users can monitor file detonation in real time and take control of the analysis virtual machine.Read 29 Sep 2026 · hatching.io
Private deployment
Hatching offers a private cloud demo environment that prospective customers can request.Read 29 Sep 2026 · hatching.io
Profiles
Profiles save analysis settings such as timeout and internet configuration, and can select a specific custom virtual machine.Read 29 Sep 2026 · hatching.io
Reports
Triage reports highlight relevant analysis results, including malware configurations extracted for a growing number of malware families.Read 29 Sep 2026 · hatching.io
Scale
Hatching says Triage can scale to 500,000 analyses per day.Read 29 Sep 2026 · hatching.io
Security and data location
Hatching's privacy policy says data is stored on servers in the Netherlands, stored personal data is encrypted, and physical locations follow ISO 27001 and SOC 2 requirements at a minimum.Read 29 Sep 2026 · hatching.io
Submissions
Triage supports more than 100 file types and archives, and automatically selects a dynamic analysis environment after unpacking and static analysis.Read 29 Sep 2026 · hatching.io
Supported analysis platforms
Triage supports analysis for Windows 7 and 10, Linux, Android, and macOS.Read 29 Sep 2026 · hatching.io

Plans and prices

Triage volume-based license Priced on request Packages start at 500 analyses per day and scale toward 50,000 per day; bespoke enterprise volumes available Read 29 Sep 2026 · hatching.io

Every Hatching Triage plan and price →

Strong points and limits

Strong points

  • Analyzes more than 100 file types and archives
  • Live monitoring with VM control
  • REST API and Cortex XSOAR integration
  • Free public-cloud access for individuals and researchers

Limits

  • Active-account data is retained indefinitely
  • Submissions and reports remain after account deletion
  • Deleted data may remain in backups for up to 30 days

Who it suits

Triage is aimed at security service providers, MSSPs, SOAR companies, in-house SOCs, and CERTs. Individual users and researchers can use the public cloud for free.

Verdict

Triage combines automated file analysis with live VM control, configurable profiles, and API-based workflows. Free public-cloud access is available to individuals and researchers, while private deployment details are available through a demo request.

Where Specifiction places it

Alternatives to Hatching TriageAll alternatives →