A model that will read the sample with you
Triage is a pile of strings, disassembly and sandbox notes. You want a model that will say what the import table is for, not one that refuses because the file looks like malware, which it is, which is why you opened it.
SOC malware queues, reverse engineers, and university malware labs working on samples they are allowed to hold.
Why the mainstream APIs fail here
Frontier hosts will not explain a packer, a process-hollowing sequence, or a ransomware note. They treat the artefact as a request to build malware. The analyst already has the sample. They need a second reader, not a policy engine.
How Redline is used for this
Paste strings, decompiler output or sandbox traces. Ask for families, persistence, C2 shape, and what to hunt for next. The completion is not stored. The cost is. A key per queue stops a noisy overnight batch from draining the lab budget.
A working loop
- Keep the binary in the lab; send strings, IL or sandbox JSON.
- Ask for family, persistence and the next hunt query.
- Cap the key that the overnight batch uses so a loop dies at the dollar you set.
Prompts are not stored. A signed receipt of the hash comes back on every call, so you can prove later what Redline logged. Details are on the privacy page. Per-model prices are on /models and the pricing model is on /pricing.