> ## Documentation Index
> Fetch the complete documentation index at: https://docs.decodalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> AI-powered malware analysis. Upload samples, decode threats, and generate intelligence reports with conversational analysis.

## What is DECODA?

DECODA is a malware analysis platform that combines conversational AI with a full static analysis toolkit. Upload a suspicious file, ask questions in plain English, and let the AI run tools like Ghidra, YARA, and Python scripts inside an isolated sandbox to break down what the sample does.

Whether you're triaging alerts in a SOC, conducting deep reverse engineering, or learning how malware works, DECODA handles the heavy lifting so you can focus on understanding threats.

## Key Capabilities

<CardGroup cols={2}>
  <Card title="Two Analysis Modes" icon="comments">
    **Ask mode** for quick Q\&A about samples. **Agent mode** for autonomous, tool-driven deep analysis.
  </Card>

  <Card title="Automated Triage" icon="bolt">
    Every upload is automatically hashed, scanned with YARA rules, and classified by type.
  </Card>

  <Card title="Sandboxed Tooling" icon="shield-halved">
    Ghidra, YARA, Python, and 20+ more tools run inside isolated Firecracker microVMs with network disabled. No risk of malware callbacks.
  </Card>

  <Card title="Threat Intelligence Reports" icon="file-lines">
    Generate structured reports with IOCs, MITRE ATT\&CK mappings, and executive summaries. Export as Markdown, PDF, HTML, DOCX, JSON, XML, CSV, or MITRE Navigator.
  </Card>
</CardGroup>

## Who is DECODA for?

* **SOC Analysts** looking to speed up alert triage and sample classification
* **Incident Responders** who need fast, actionable intelligence from suspicious files
* **Reverse Engineers** who want AI assistance with static analysis workflows
* **Security Students** learning malware analysis and reverse engineering techniques
* **Threat Hunters** building detection rules and tracking adversary TTPs

## Get Started

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Upload your first sample and run your first analysis in minutes.
  </Card>

  <Card title="Analysis Modes" icon="code" href="/guides/analysis-modes">
    Learn the difference between Ask and Agent mode, and when to use each.
  </Card>

  <Card title="Triage Pipeline" icon="microscope" href="/guides/triage">
    Understand what happens automatically when you upload a sample.
  </Card>

  <Card title="Reports" icon="file-lines" href="/guides/reports">
    Generate and export structured threat intelligence reports.
  </Card>

  <Card title="Interface Features" icon="window" href="/guides/interface">
    Chat sharing, the file context panel, and other interface features.
  </Card>
</CardGroup>

## Reference

<CardGroup cols={3}>
  <Card title="Supported File Types" icon="file" href="/reference/supported-file-types">
    26+ file types from PE to PCAP, with detection methods and tool routing.
  </Card>

  <Card title="Analysis Tools" icon="wrench" href="/reference/analysis-tools">
    Detailed reference for every tool available in Agent mode.
  </Card>

  <Card title="IOC Categories" icon="crosshairs" href="/reference/ioc-categories">
    All indicator types DECODA can extract, with export formats.
  </Card>
</CardGroup>

## Account & Help

<CardGroup cols={2}>
  <Card title="Plans & Billing" icon="credit-card" href="/guides/billing">
    Subscription tiers, usage limits, and the credit system.
  </Card>

  <Card title="Security & Privacy" icon="lock" href="/guides/security">
    How DECODA isolates malware and protects your data.
  </Card>
</CardGroup>
