Community Tier Free

The Community tier is the full Intreys engine with usage limits suited for individual analysts, students, CTF players, and homelabs. No credit card. No expiry. No telemetry.

What's included

• 50,000 packets per capture — most home/lab PCAPs fit easily
• 50 MB file size limit per uploaded PCAP
• Single-user mode — one local profile, one machine
• All 67 protocol dissectors — including ICS/SCADA and IoT
• Automated threat hunts — beacons, DNS tunneling, scans, exfil, lateral movement
• Live packet capture on all platforms (now available on every tier in v1.0.0; previously paid-only)
• Local AI via llama.cpp or MLX (your hardware, no cloud)
• Basic CSV export of findings, alerts, and packet lists
• Threat intelligence with bring-your-own-key (free tiers of AbuseCH, GreyNoise Community, OTX)

What's not included

• MITRE ATT&CK matrix overlay (Pro)
• PDF and DOCX reports (Pro)
• STIX 2.1 / MISP / Sigma export (Pro)
• YARA rule scanning (Pro)
• Multi-user / real-time team collaboration (Team)
• OIDC SSO, ICS/SCADA, SIEM forwarders — Splunk, ELK, Syslog (Team)
• SCIM 2.0 provisioning, multi-tenant case isolation, compliance mapping, BYOK / CMEK (Enterprise / MSSP). SAML 2.0 SSO available by request as an enterprise preview.
• Priority email support (Pro+)

Tips for getting more out of Community

Pre-trim large captures

If your capture is over 50 MB or 50,000 packets, trim with tcpdump or editcap before uploading:

# Keep first 50,000 packets
editcap -r huge.pcap small.pcap 1-50000

# Keep only HTTP traffic
tcpdump -r huge.pcap -w http-only.pcap 'tcp port 80 or tcp port 443'

Run live capture in short bursts

Live capture has the same packet/file limits. Use short captures (30 seconds, 60 seconds) when triaging. Save the raw PCAP and re-analyze with finer scope.

Bring your own threat intel keys

Sign up for free-tier API keys at AbuseIPDB, GreyNoise (Community), and AlienVault OTX. Add them in Settings → API Keys. The Community tier supports the free tiers of all major TI providers.

When to upgrade

• You routinely analyse PCAPs > 50 MB or > 50K packets
• You need PDF/DOCX reports for clients or stakeholders
• You want STIX/MISP/Sigma export for downstream tooling
• You want commercial-grade AI analysis (Claude, OpenAI) with privacy controls
• You want MITRE ATT&CK matrix overlay and Navigator export

See Professional tier or start a 7-day free trial.

Privacy & telemetry

Community tier is fully local. No analytics, no crash reports, no usage telemetry. The only outbound network calls are:

• Daily update check to releases.intreys.com (can be disabled in Settings)
• Threat-intel queries you initiate (only to providers whose keys you’ve configured)
• AI provider calls if and only if you’ve opted into a remote provider