Welcome to the Hawk Eye Family

01Getting started

Aerie runs entirely in your browser — there's nothing to install. Everything works on desktop and mobile.

Create your account

1. Open the Aerie login page and choose Create account.
2. Pick a display name and a password. Your password is stored only as an irreversible cryptographic hash — it can never be read back, even by us.
3. The very first account created on a fresh instance becomes the administrator. Everyone after that is a standard hunter with full access to analysis, feeds, watchlists, rules, and testing.
4. You'll land on your Deck — your home base.

02The interface at a glance

Aerie has a consistent layout on every page: a top bar, a navigation rail, and the main workspace.

03Settings & your access key

To unlock the deepest analysis — full multi-engine detections and the behavioural report — Aerie uses a personal analysis key that you provide. It's the one piece of setup worth doing first.

Adding your analysis key

1. Get a free VirusTotal API key by registering at virustotal.com and copying the key from your profile.
2. In Aerie, open Settings and paste your key into the analysis-key field, then save.
3. That's it. Your key lives only in your own browser and is sent along transiently, only on the requests that need it — it is never stored on our side.

Account management

• Change password — update your password at any time.
• Delete account — permanently removes your account and everything tied to it. This can't be undone.

04Analysing an indicator

This is the core of Aerie. Head to Checks, and you can analyse any of:

Aerie auto-detects what you've pasted and shows the type. Press Analyse and it runs everything at once.

One button, the whole picture

The single Analyse action replaces the old "check it" and "detonate it" split. When you analyse a hash or a URL, Aerie simultaneously:

• Checks it against multiple reputable security engines and threat-intel sources;
• Cross-references it with community malware repositories and curated indicator feeds;
• Matches it against your own growing behavioural rule database;
• And detonates it live in a sandbox to capture what it actually does.

Live progress

Detonation and deep analysis take a little time. Aerie shows a live progress ring right in the report with the current stage ("Detonating in sandbox", "Analysing"), elapsed time, and your position in the queue. It never sits frozen, and if the connection blips it reconnects automatically. If you close the view mid-run, the analysis keeps going — you'll find it in your Scans popover and in Recent checks, and reopening it resumes the live view.

05Reading the verdict

Every report opens with a threat ring — a 0-to-100 score — and a headline verdict. Here's what each verdict means:

Alongside the verdict you'll see a confidence percentage — how sure Aerie is — and, where known, the malware family.

06The Aerie interpretation

This is what sets Aerie apart. Rather than dumping raw detections on you, Aerie reasons about them and explains itself in plain language.

How it weighs the evidence

Aerie treats sources with the nuance they deserve. A wall of low-quality detections doesn't move it much; a couple of top-tier engines, or unmistakable behavioural tradecraft, does. Some highlights of its judgement:

• Reliable engines carry more weight. Hover over any engine's detection to see a reliability badge and an explanation of its naming style (a machine-learning label vs. a genuine family name vs. a reputation score).
• Behaviour can be conclusive on its own. If a sample injects code, evades security tooling, and hides its tracks, Aerie will call it malicious even when few engines have caught up.
• Sandbox disagreement is flagged, not hidden. If one sandbox says "harmless" while the behaviour clearly shows evasion, Aerie tells you the sample most likely detected the sandbox and held back — and doesn't trust the clean verdict.
• Community matches are treated with care. A hit in a community upload repository raises suspicion but, on its own, isn't treated as proof — it needs a second opinion to become conclusive.

07Understanding the sources

Under the verdict, each source card shows one opinion. Green means it flagged something, grey means clean or not seen, and an animated pulse means it's still working. Here's who's in the room:

A source card may also say unavailable (that source doesn't apply to this indicator type) or error (it couldn't be reached this time) — Aerie always tells you which, rather than silently pretending everything's clean.

08The behavioural report

When a sample has been detonated, Aerie renders a full behavioural report — the story of what it did — split into clear, scrollable sections.

Network activity

• DNS lookups — the domains it resolved, with the IPs they pointed to.
• HTTP requests — the web requests it made, with method and status.
• Contacted IPs — direct connections, with port and protocol.
• In-memory network IOCs — domains, URLs, and IPs found in memory that may never have been contacted during the run but reveal intent.

Host activity

• Processes / commands — what it launched and the command lines it used.
• Files written & dropped — everything it placed on disk.
• Registry changes — keys it set, which often reveal persistence.
• Mutexes, services, and loaded modules — the lower-level fingerprints of its execution.

Sandbox signatures & MITRE ATT&CK

Below the raw activity, Aerie lists the behavioural signatures the sandbox matched (e.g. "executes direct syscalls to evade security tooling") and maps the sample's techniques onto the MITRE ATT&CK framework. Each technique shows its official name and tactic and links straight to the ATT&CK page, so you can go from "what it did" to "what that's called" in one click.

09Report actions toolbar

At the top of every report sits a toolbar. The buttons that appear depend on what the report contains.

10Detection & removal generation

When a report has behavioural data, three more buttons appear — turning analysis into something you can deploy.

Sigma & YARA rules

One click each generates a ready-to-tune Sigma detection rule (built from the network, file, and registry indicators) and a YARA rule (built from strings and infrastructure). Both open in a copyable, downloadable panel.

PowerShell removal script

For a malicious sample, Aerie generates a remediation script that removes what the malware did on a machine:

• Terminates the related processes;
• Removes persistence — Run and RunOnce keys across every hive, including the 32-bit-on-64-bit locations;
• Unregisters malicious scheduled tasks;
• Stops and deletes malicious services;
• Deletes the dropped and written files.

Paths are automatically made portable — sandbox environment variables and user placeholders are resolved to their live equivalents, so the script works on a real machine and against any user account rather than only the one the sample happened to run under.

11The Watchlist

Some verdicts aren't final — a fresh sample might be clean today and flagged next week. The Watchlist turns Aerie from a lookup tool into a monitoring one.

1. Hit Watch on any report, or add an indicator directly from the Watchlist page.
2. Aerie re-checks watched items automatically on a schedule, keeping a full history of every verdict over time.
3. When a verdict changes, the item is flagged — it floats to the top with a "changed" badge, so you never have to keep looking.
4. Open a flagged item to see the latest report, Acknowledge the change to clear the flag, or Stop watching to remove it.

12Behavioural Rules — the Helios ruleset

This is Aerie's living memory. Whenever you analyse something and its behaviour is judged malicious, Aerie automatically distils it into a permanent behavioural signature and stores it. Each one gets a stable identifier:

HNP:BS!000123

Helios Nano Power · Behavioural System · sequential ID

What a rule captures

Each signature records the threat's C2 domains and IPs, dropped and written files, registry persistence, mutexes and services, MITRE techniques, and the file's metadata — along with the interpreter's plain-English summary of why it's malicious. Everyday benign infrastructure is filtered out, so a rule only contains signal, never noise.

It gets smarter with every hunt

• Automatic & deduplicated. Analyse the same threat twice and it doesn't create a duplicate — the existing rule's hit count goes up and any new indicators merge in.
• It matches future indicators. Every new analysis is checked against the ruleset. If your new indicator appears in a stored signature, you'll see a Helios Behavioural Rules match right in the report — past hunts informing present ones.
• A rule chip appears on reports that created or matched a signature, linking straight to it.

Managing the ruleset

The Rules page lists every signature, searchable and filterable by severity. Open one to see all its indicators grouped, its MITRE techniques with links, hit count, and provenance. From there you can export it as JSON or a Sigma rule, disable it (keeps it but stops it matching), or delete it.

13Live threat feeds

Aerie keeps continuously-updated feeds so you're always hunting today's threats. All three support search, sorting, and source/type filters, and every entry is one click from a full analysis.

Phishing

A live, de-duplicated stream of phishing URLs pulled from several reputable sources and merged so no single source dominates — the freshest indicators surface at the top.

Malware URLs

Malicious URLs split into Phishing and Malware-distribution divisions, sorted newest-first.

Malware samples

Recent confirmed malware, filterable by file type: Executables, Documents, Scripts, Archives, Linux, Android, macOS, and Web/email. Choosing a category pulls real, current samples of that type — so "Documents" gives you genuine document-borne malware, not whatever happened to be in the last batch. Each sample can be looked up, detonated, downloaded, or added to a test basket.

14AV testing & campaigns

This is where Aerie turns testing your security products into a team sport. A campaign lets you line up a set of samples and record, side by side, exactly what each product caught.

Building a test set — the basket

As you browse the malware feed or analyse samples, add the interesting ones to your test basket with "I will use this for the test." When you're ready, start a campaign from the basket in one step.

Running a campaign

1. Create the campaign and give it a name. You become its lead.
2. Add samples — from your basket or by pasting hashes.
3. Invite the team. Other hunters can join; as lead you approve who participates. (Leads and admins are auto-approved, and can test alongside everyone.)
4. Everyone records their verdicts — each participant marks, for each sample, whether their product detected it.
5. Read the matrix. Aerie lays out a side-by-side comparison so you can see at a glance which product caught what.

As lead you can manage participants, remove samples, and open or close the campaign. It's the difference between a lonely spreadsheet and a shared, living scoreboard.

15The solutions catalog

The Solutions page is a catalog of security products — the contenders you can line up in a campaign. Browse and filter the built-in list, and add your own products if something you test isn't there yet. It keeps your testing consistent: everyone's comparing the same named solutions.

16History & sharing

Recent checks

Everything you analyse is saved to your account and stays there across sessions, on the Checks page. Search it, sort it (newest, highest threat, name), and filter by verdict. A still-running detonation shows as Analysing… — click it and the live view resumes exactly where it left off, even after a page reload.

Sharing a finding

Use Share link on any report for a clean, read-only page anyone can open without an account. It shows the full report — verdict, sources, and behaviour — with the interactive controls stripped, and expires automatically. Perfect for "look at this" without exporting a file.

17Best practices & safety

18Glossary