Triage

At a glance

• Editor score
  6.6 / 10
• Pricing
  Free plan
• Best for
  Analysts handling non-sensitive samples
• Free plan
  Yes
• File scanning
  Yes
• Facts checked
  14 Nov 2026

• Where it wins

  • Analyzes both files and URLs with static and behavioral methods
  • Extracts archives and container formats for inspection
  • Supports YARA rules, configuration extraction, and API automation

• Where it doesn't

  • Public submissions and results are visible and cannot be deleted
  • Individual access is limited to non-commercial use
  • Private analysis requires a separate Recorded Future Enterprise Sandbox

Our verdict on Triage

Triage is a cloud-based malware analysis sandbox from Recorded Future for security researchers and analysts who need to examine suspicious files or links. Its public service accepts file and URL submissions and provides both static analysis, which does not execute a sample, and behavioral analysis in a controlled environment. That combination makes it relevant for analysts conducting initial triage and investigating sample behavior, provided the material is suitable for public submission.

Analysis can extend beyond a basic verdict. Triage extracts archives and container formats, runs YARA rules and heuristic signatures, and can extract supported malware configurations. Behavioral reports can include registry events, file operations, network requests, and memory dumps. A REST-like API supports automated sample analysis, making the service useful in workflows that submit samples programmatically. Access is through the web and API, with cloud deployment; the listed support channel is email.

The key boundary is confidentiality: submissions and analysis results in the public sandbox are visible publicly and cannot be deleted. Individual access is non-commercial, so organizations handling proprietary or sensitive samples should not treat the public service as a private analysis environment. Recorded Future offers a separate Enterprise Sandbox for private analysis, with sales handled through the vendor. Triage's public service is free to access, while no Triage-specific public price is stated for enterprise use. Choose Triage for non-commercial, public-suitable file and URL investigation or API-driven triage; choose another option or inquire about the enterprise offering when privacy or commercial use is required.

Your product? Our editors can test Triage in depth and publish a review, labelled as paid · from $149/mo →

Triage pricing

Triage fact sheet

Alternatives to Triage

• JSJoe SandboxA configurable sandbox for deep file, URL, network, and IOC analysis.8.9
• Hybrid AnalysisA free cloud sandbox combining file, URL, behavioral, network, and IOC analysis.8.8
• ANY.RUNA cloud sandbox for examining suspicious files and URLs through live behavior and network analysis.8.7

See all Triage alternatives →

Featured on iTechGuides

Triage is listed in our Online Virus Scanners directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/triage-online-virus-scanner/"><img src="https://www.itechguides.com/best/badge/triage-online-virus-scanner.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update