The first evaluation release of the actor-centric Cyber Threat Intelligence platform. Hadal brings the full collection-to-attribution pipeline together and adds Mantis, native malware analysis, as a first-class service.
The hadal zone begins where light has long since vanished, the trenches below 6,000 metres. It is where Kraken belongs: deep beneath the surface noise, where adversary infrastructure actually lives.
Surface tools see scattered indicators. Hadal is built to descend past them, tracking infrastructure as a living system, clustering it into actors, and surfacing the connections that static IOC lists never show.
Malware analysis is no longer a separate tool. Mantis ships inside Kraken, sharing databases, auth and events.
Collection, scheduling, import, graph enrichment and confidence, the full lifecycle in a single system.
26 IIM techniques capture how actors build infrastructure, the layer between raw IOCs and ATT&CK.
A node-based Automation Builder turns events into workflows, no code, runs on the live event stream.
Custom Python modules build into isolated containers via the Foundry, no changes to the core.
Every entity ties back to its evidence and a confidence score tracked over time. Always answer “why?”
Grouped by area. All items below are implemented and available in this evaluation build.
Hadal’s defining change: malware analysis becomes part of Kraken itself. Mantis runs as a dedicated service, sharing the same databases, user authentication and event system as the core. Upload a sample, and the result flows straight into attribution and the intelligence graph.
Hadal is the first eval build, aimed at the earliest registrants who want hands-on time with the platform. Expect rapid iteration: your feedback feeds directly into what ships next. Kraken is not a public platform; access is restricted and granted through a manual review process.
Not in this release, but on the way. Listed here for transparency about where Hadal goes next.
Automated dynamic analysis for submitted binaries with network, DNS and dropped-file results mapped straight into the graph.
Policy-controlled sharing between Kraken instances via a central hub, trust tiers, mTLS, snapshot signing and redaction.
Automated confidence adjustment based on the historical accuracy of each source over time.
Kraken 1.0‑eval «Hadal» is open to the first registrants who want to put the platform to work. Request access, get vetted, and dive into the full feature set, with a direct line to the team.