Recorded Future Triage
Cloud malware sandbox for Windows, Linux, macOS, and Android samples with automated scoring.
Technical Architecture & Overview
Recorded Future Triage, originally the Hatching Triage sandbox and documented by Recorded Future as its malware analysis sandbox (Recorded Future Sandbox), detonates samples across desktop and mobile platforms and assigns a maliciousness score from 1 to 10. Analysts can interact with running analyses through the Live Monitor, apply organization analysis profiles for network mode, geolocation, and timeout, and query the public corpus of prior reports. A free public access tier exists, and the platform became part of Recorded Future after its 2022 acquisition, which itself is now a Mastercard subsidiary.
Targeted Technical Use Cases
Batch triage of attachments and URLs with consistent scoring, plus searches over a large public detonation corpus.
Evaluation & Trade-offs
Core Strengths
- +Broad platform support with scripted and interactive detonation.
- +Public corpus supports hash and behavior search.
- +Free public sandbox for submitting and analyzing samples.
Trade-Offs & Limitations
- -Public analyses are visible to other users.
- -Full capability requires a commercial subscription.
Defensive Security Application
Scoring and triaging incoming samples at scale and retrieving historical detonations for known hashes.
Frequently Asked Questions
What is Recorded Future Triage?→
Recorded Future Triage, originally the Hatching Triage sandbox and documented by Recorded Future as its malware analysis sandbox (Recorded Future Sandbox), detonates samples across desktop and mobile platforms and assigns a maliciousness score from 1 to 10. Analysts can interact with running analyses through the Live Monitor, apply organization analysis profiles for network mode, geolocation, and timeout, and query the public corpus of prior reports. A free public access tier exists, and the platform became part of Recorded Future after its 2022 acquisition, which itself is now a Mastercard subsidiary.
What is Recorded Future Triage used for?→
Batch triage of attachments and URLs with consistent scoring, plus searches over a large public detonation corpus.
What are the strengths of Recorded Future Triage?→
- +Broad platform support with scripted and interactive detonation.
- +Public corpus supports hash and behavior search.
- +Free public sandbox for submitting and analyzing samples.
What are the limitations of Recorded Future Triage?→
- +Public analyses are visible to other users.
- +Full capability requires a commercial subscription.
How is Recorded Future Triage used defensively?→
Scoring and triaging incoming samples at scale and retrieving historical detonations for known hashes.