Cyber Triage Pricing

There are three versions of Cyber Triage and all include access to threat intelligence, software upgrades, and unlimited technical support. A license is required for each responder using the software and each has volume-based limits for threat intelligence access.


Runs on responder’s computer
1 to 2 hosts per week per responder

$2,500 /year/user

Standard Pro

Runs on responder’s computer
10 to 12 hosts per week per responder

Get Quote


Client-server architecture
10 to 12 hosts per week per responder

Get Quote

Cyber Triage will save you money per year by:

Reducing investigation times by hours or days each time

Providing you access to threat intelligence feeds that cost tens of thousands of dollars.

Reducing the time your senior responders need to spend with junior responders

Feature Overview

Standard Standard Pro Team
Network- and S3-based collections
Artifact scoring and malware scanning
Recommendation engine
Queue up and analyze multiple hosts at the same time
Collaborate and share results within team in real time
REST API, SIEM, and EDR integrations

Feature Breakdown

Standard Standard Pro Team
Collects volatile and file system data
Collect to and from USB
Collect over the network
Collect to S3 bucket
Imports disk images
Imports KAPE output
Imports logical files
Imports memory images (uses Volatility 2)
Queue up multiple file-based collections
Queue up multiple network-based collections
Streaming ingest for EDR deployments
Triggered by SIEM or SOAR
Uses dozens of heuristics to identify suspicious items
Detect malware using ReversingLabs
Malware scanning limits 5000/week 4000/day 4000/day
Analyzes files using Yara rules
Hides known good items with allow lists
Flags IOCs with bad lists
Analyzes several hosts simultaneously
Synchronize threat intelligence lists across all clients
Manually score an item as good or bad
Recommends additional items based on scoring
Pivot through collected data to determine scope
View timeline of threats to get context
Correlates with single user’s previous collection to determine how common item is
Groups hosts by incident for better reporting and correlation
Collaborate and share data amongst the team
Correlates with all user’s previous collections to determine how common item is
Generates HTML, Excel, and CybOX reports
Produces JSON report that can be imported into SIEMs
Custom report branding
Integrates with SIEMs and orchestration tools using REST API
Stores data in a multi-user database
Run as a windows service