Deep packet inspection and threat analysis platform for network forensics, threat hunting, and incident response. 59 protocol dissectors. Automated threat hunts. No cloud required.
From initial triage through structured export, Intreys covers the full investigation lifecycle.
Wireshark-compatible display filters, full TCP/UDP stream reassembly, hex dump inspection, protocol tree dissection, and expert info panels. Virtual scrolling handles 500K+ packet lists.
C2 beacon detection, DNS tunneling, data exfiltration, lateral movement, port scanning, credential theft, and covert channel analysis. Hypothesis-driven hunts with playbook-guided investigation.
Attack narrative generation with Mermaid diagrams. Local AI via MLX (Apple Silicon) or llama.cpp. Cloud providers supported with privacy controls and cost tracking.
10 industrial protocol dissectors including Modbus, DNP3, S7comm, IEC-104, and OPC UA. Security policy enforcement, dangerous operation detection, and per-host health scoring.
Cross-platform libpcap integration with lock-free ring buffer. Real-time analysis with SSE streaming. PCAP file writing for captured traffic. No external tools required.
Visual ATT&CK matrix with detected techniques. Pyramid of Pain indicator classification. ATT&CK Navigator JSON export for team collaboration.
STIX 2.1, MISP, TAXII 2.1, Sigma rules. PDF and DOCX reports. Full JSON and CSV export. YARA rule scanning on extracted artifacts.
Role-based access control, encrypted API key storage, login rate limiting, CSP headers, token blacklisting, audit logging, and Ed25519-signed license verification.
Online enrichment via AbuseIPDB, VirusTotal, GreyNoise, OTX, Shodan, and URLScan. Threat feed ingestion with local caching for offline use. DGA detection.
No tshark, Wireshark, or Suricata required. Every dissector is implemented in pure Python.
Start free. Scale when you need to.
Download the Community edition or clone from GitHub. No signup required.
Available for macOS, Linux (Debian, RPM), Windows, and Docker.
Python 3.11+ required for source installation.