Getting Started with Intreys™

From install to first finding in under ten minutes. This guide assumes Community tier — everything below works without a paid license.

1. Download & install

macOS

v1.0.0 ships macOS Apple Silicon (ARM64) only. Intel Macs (x86_64) are not supported in v1.0.0. Download Intreys_<version>_aarch64.pkg from the Intreys download page and double-click to install. The installer registers an Intreys ChmodBPF helper (LaunchDaemon com.cybershelt.intreys.ChmodBPF) that grants the access_bpf group read+write on /dev/bpf* so Live Capture works without sudo.

If you only need offline PCAP / email / cloud-flow analysis, you can skip the .pkg and use the unsigned Intreys_<version>_aarch64.dmg instead. Live Capture will not work without the helper.

# Verify (optional)
shasum -a 256 ~/Downloads/Intreys_*_aarch64.pkg
# Compare against the SHA-256 published on the release page.

Windows 10/11

Run Intreys-Setup-x64.exe. The installer bundles Npcap. If you already have Npcap installed, the installer will detect it.

Linux (Debian/Ubuntu)

Both amd64 (x86-64) and arm64 (aarch64) builds are published — pick the .deb matching your CPU architecture (dpkg --print-architecture).

# Verify the GPG signature (optional but recommended)
curl -fsSL https://intreys.com/.well-known/intreys-release.asc | gpg --import
gpg --verify intreys_*_amd64.deb.asc intreys_*_amd64.deb   # expect "Good signature"

sudo dpkg -i intreys_*_amd64.deb   # x86-64 hosts
# or, on ARM64 hosts (ARM Ubuntu / Parrot OS / Raspberry Pi OS 64-bit):
sudo dpkg -i intreys_*_arm64.deb
# postinst grants cap_net_raw to /usr/bin/intreys-capture
# so live capture works without sudo

Linux (portable AppImage)

chmod +x Intreys-*.AppImage
./Intreys-*.AppImage

Docker

Intreys does not publish a prebuilt container image for v1.0.0. To self-host in Docker, build the image from the included Dockerfile — see the Deployment guide.

2. First run

Launch Intreys. The app walks you through setup once:

1. Accept the End User License Agreement. You can read the full Terms of Use and Privacy Policy before agreeing.
2. Create your owner account. Provide your name, work email, company (optional), a username, and a password. The owner account is created locally; nothing is sent to Intreys infrastructure.
3. Verify your email or activate a license if you’re starting a Professional trial or activating a paid tier. Community users skip this step.
4. Sign in. The dashboard loads with a risk gauge, packet stats, protocol distribution, and top-risk IPs.
5. A welcome panel offers a sample PCAP — click Load sample to skip ahead.

3. Your first PCAP analysis

1. Click Upload in the topbar (or press Ctrl/Cmd + O).
2. Drop a .pcap or .pcapng file (up to 50 MB on Community).
3. The 21-stage pipeline starts automatically. You can watch progress in the right-rail.
4. When stage 21 completes, the Dashboard refreshes with findings.

Don’t have a PCAP? Try one of these public sample sources:

• malware-traffic-analysis.net — real malware captures with write-ups
• NETRESEC public PCAP repository
• SampleCaptures bundled with Wireshark (often in /usr/share/wireshark)

4. Reading your first finding

Open the Alerts view (Ctrl/Cmd + 4). Each row is a detection with a severity, a one-line description, and a link to the relevant flow or packet. Click a row to expand the detail panel:

• Why we flagged this — the rule or heuristic name and the signal that fired
• What you should do — suggested next step (block, isolate, investigate, ignore)
• Linked artifacts — the packet IDs, hosts, files, and IOCs involved
• MITRE technique — if applicable, with a link to the ATT&CK matrix view

5. Recommended next reads

• PCAP analysis — the pipeline stages explained
• Live capture — capture on your local interface
• Threat hunting — hypothesis-driven investigation
• AI providers — AI narrative summaries (paid tiers; local AI via Offline AI Pack)

Keyboard shortcuts

Need help?

• Troubleshooting — the 30 most common issues, with fixes
• FAQ — questions buyers and users ask
• Support ticket — reach a human