Triage review
Free file and URL analysis with static, behavioral, and API-based workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Triage is a cloud-based malware analysis sandbox from Recorded Future for security researchers and analysts who need to examine suspicious files or links. Its public service accepts file and URL submissions and provides both static analysis, which does not execute a sample, and behavioral analysis in a controlled environment. That combination makes it relevant for analysts conducting initial triage and investigating sample behavior, provided the material is suitable for public submission.
Analysis can extend beyond a basic verdict. Triage extracts archives and container formats, runs YARA rules and heuristic signatures, and can extract supported malware configurations. Behavioral reports can include registry events, file operations, network requests, and memory dumps. A REST-like API supports automated sample analysis, making the service useful in workflows that submit samples programmatically. Access is through the web and API, with cloud deployment; the listed support channel is email.
The key boundary is confidentiality: submissions and analysis results in the public sandbox are visible publicly and cannot be deleted. Individual access is non-commercial, so organizations handling proprietary or sensitive samples should not treat the public service as a private analysis environment. Recorded Future offers a separate Enterprise Sandbox for private analysis, with sales handled through the vendor. Triage's public service is free to access, while no Triage-specific public price is stated for enterprise use. Choose Triage for non-commercial, public-suitable file and URL investigation or API-driven triage; choose another option or inquire about the enterprise offering when privacy or commercial use is required.
Triage pros and cons
- Where it wins
- Analyzes both files and URLs with static and behavioral methods
- Extracts archives and container formats for inspection
- Supports YARA rules, configuration extraction, and API automation
- Where it doesn't
- Public submissions and results are visible and cannot be deleted
- Individual access is limited to non-commercial use
- Private analysis requires a separate Recorded Future Enterprise Sandbox
Triage fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update