CAPE Sandbox
7.4#3 in malware analysis sandboxesFree planFree planWebAPILinuxSelf-hosted
VisitCAPE Sandbox vs Kaspersky Research Sandbox
Kaspersky Research Sandbox
5.9#14 in malware analysis sandboxesAndroidWebAPILinux
VisitWhat both publish
| Fact | CAPE Sandbox | Kaspersky Research Sandbox |
|---|---|---|
| Deployment | The documented architecture runs each analysis in a fresh isolated virtual machine; GNU/Linux, preferably Ubuntu LTS, is the recommended host, with Windows 10 or Windows 11 23H2 as the recommended guest. | Available in cloud and on-premise deployment models, including secure air-gapped environments. |
| Founded | 2016 | 1997 |
| Integrations | The documentation covers integrations with Box-js, LibreNMS, and Suricata, and describes CAPE's modular design for integrating external services. | The product has an API for sending suspicious files for analysis and exporting results to a SOC task management system, and it can integrate with Kaspersky Private Security Network. |
| Purpose | CAPE is an open-source malware sandbox that runs suspicious files in an isolated environment while monitoring behavior and collecting forensic artifacts. | Analyzes suspicious objects to investigate their origins, collect behavior-based IOCs, and detect previously unseen malicious objects. |
CAPE Sandbox plans
- CAPE SandboxFree
- Public demonstration instanceFree
Kaspersky Research Sandbox plans
- Kaspersky Research SandboxPriced on request
Pick CAPE Sandbox if…
CAPE suits security teams and researchers who need to inspect suspicious files and automate analysis. It requires users to manage a host-and-guest deployment and take responsibility for using the tool.
Pick Kaspersky Research Sandbox if…
It suits security teams and threat researchers who need to investigate suspicious files and objects. Cloud, on-premise and air-gapped deployment options are listed.