v26.11.2 Now Live

Capture Intel.
Connect the Threat.

Turn daily reading into structured intelligence. Capture intel from web pages, reports, and articles, link threat actors & malware to entities, and map behaviors to MITRE ATT&CK in a unified analyst workspace.

  • Capture highlights & evidence
  • Custom entities & asset mapping
  • MITRE ATT&CK mapped
  • Collaborative workspaces & comments
Explore Features
Analyst Notebook dashboard showing a linked threat actor profile
Features

What You Can Do

01 / 06

Capture Intel

Highlight and record intel directly from any webpage using a lightweight browser extension without interrupting your research workflow.

  • Captures URL, page title, timestamp, and text highlights automatically
  • Attach contextual notes & tags directly to captured evidence
  • Link findings to threat actors, malware, tools, and custom entities
02 / 06

Entities & Threat Graphing

Create custom entities and link them directly to raw evidence to build a connected intelligence repository

  • Create adversaries, identities, assets, tools, malware, or custom threat objects
  • Link directly to observables including domains, IP addresses, file hashes, and email addresses
  • Connect entities to each other and map them to MITRE ATT&CK actors and tools
  • Continuously document findings with integrated analyst comments and analyst notes
03 / 06

MITRE ATT&CK Intelligence

Access in-depth analysis of recognized threat actors and tools, and leverage the community framework to build your own private intelligence repository.

  • Centralize internal intelligence directly on top of community knowledge
  • Create comprehensive threat actor profiles using integrated analyst notes
  • Build comprehensive tool and malware profiles using integrated analyst notes
04 / 06

Built for Business & Teams

Empower your entire team with full enterprise functionality. Invite team members with full feature access to share notes, entities, and collaborate on threat intelligence.

  • Flexible seat allocation with full enterprise feature access for every member
  • Share notes, custom entities, and comments across your organization
  • Eliminate duplicate analyst research with unified threat repositories
05 / 06

Export Your Intelligence

Take your research anywhere. Export an entity, threat actor or malware profile in one click, with everything your team has learned about it.

  • Structured JSON for tools, or readable Markdown for reports
  • Include analyst notes, highlights and the source page each note came from
  • Keep linked threat actors, malware, tools and entities with every export
  • Available on every plan, including Community
06 / 06

Data API Enterprise

Feed your team's intelligence straight into your SIEM, SOAR or data pipeline. Set up an API in about a minute, with no code to write.

  • Choose the collections, entity types and fields each API returns
  • JSON with your own field names, or standard STIX 2.1 bundles
  • Add MITRE ATT&CK IDs and techniques for linked threat actors and malware
  • Sync only what changed, with a separate secret auth code for every API

Subscription Tiers

Choose the right plan for individual threat research or team-wide threat actor and entity tracking.

Community

No Credit Card Required

For community cybersecurity researchers and hobbyists starting out.

$0 / forever
  • 200 Captured Highlights
  • 50 Created Entities
  • Up to 5 Collections

PRO

For independent professional threat analysts and cybersecurity researchers.

$6/month
  • Unlimited Captured Highlights
  • Unlimited Created Entities
  • Unlimited Collections

Enterprise

For small teams and larger threat intelligence groups working on shared research.

$25/month
  • Unlimited Highlights, Entities & Collections
  • You plus 5 team members
  • Add members any time for $6/month each
  • Shared Team Workspaces

On-Prem

Air-gapped deployment for high-compliance and strict data sovereignty environments.

Custom Quote
  • Isolated Air-Gapped Deployment
  • Dedicated Offline Data Updates
  • Custom Threat Data Integrations

What will it cost?

Enter how many people will use HC IntelLab, including you.

Enterprise: you plus 5 members are included.

Monthly

$25/month

$300 a year

Yearly Save $5

$295/year

About $24.58 a month

You can add or remove members at any time.

v · Shipping Weekly

Ready to centralize your cyber intelligence?

Start capturing and connecting intel today. Our team ships new capabilities every week — see what's live and what's next on the roadmap.

See what's coming next

Check our public roadmap or request a feature.

View Roadmap
Direct Intel [email protected]
Response Time < 24 Hours

★ Magic Link Access

Got Questions?

Frequently Asked Questions

Everything you need to know about capturing evidence, building threat graphs, and collaborating.

No! The Community plan is completely free and requires no credit card registration to start using. For our Pro and Enterprise plans, we offer a 14-day free trial so your team can test all premium features risk-free. You can easily cancel anytime during the trial period directly from your account settings without being charged.