Recorded Future Triage
Cloud malware sandbox for Windows, Linux, macOS, and Android samples with automated scoring.
Technical Architecture & Overview
Recorded Future Triage, originally the Hatching Triage sandbox, detonates samples across desktop and mobile platforms and assigns a maliciousness score from 1 to 100. Analysts can interact with sessions in a browser, schedule behavior overrides, and query the public corpus of prior reports. A free public access tier exists, and the platform became part of Recorded Future after its 2022 acquisition, which itself is now a Mastercard subsidiary.
Targeted Technical Use Cases
Batch triage of attachments and URLs with consistent scoring, plus searches over a large public detonation corpus.
Evaluation & Trade-offs
Core Strengths
- +Broad platform support with scripted and interactive detonation.
- +Public corpus supports hash and behavior search.
- +Free tier for individual analysts.
Trade-Offs & Limitations
- -Public analyses are visible to other users.
- -Full capability requires a commercial subscription.
Defensive Security Application
Scoring and triaging incoming samples at scale and retrieving historical detonations for known hashes.
Frequently Asked Questions
What is Recorded Future Triage?→
Recorded Future Triage, originally the Hatching Triage sandbox, detonates samples across desktop and mobile platforms and assigns a maliciousness score from 1 to 100. Analysts can interact with sessions in a browser, schedule behavior overrides, and query the public corpus of prior reports. A free public access tier exists, and the platform became part of Recorded Future after its 2022 acquisition, which itself is now a Mastercard subsidiary.
What is Recorded Future Triage used for?→
Batch triage of attachments and URLs with consistent scoring, plus searches over a large public detonation corpus.
What are the strengths of Recorded Future Triage?→
- +Broad platform support with scripted and interactive detonation.
- +Public corpus supports hash and behavior search.
- +Free tier for individual analysts.
What are the limitations of Recorded Future Triage?→
- +Public analyses are visible to other users.
- +Full capability requires a commercial subscription.
How is Recorded Future Triage used defensively?→
Scoring and triaging incoming samples at scale and retrieving historical detonations for known hashes.