What’s New?

• Cyber Threat Intelligence (STIX/TAXII Feed) Integration for operationalized threat intelligence: AIR can now connect to TAXII 2.x threat intelligence sources, pull STIX indicators, parse supported indicator types, and convert them into YARA, Sigma, and osquery Hunt/Triage rules. This helps analysts bring external threat intelligence directly into investigations without manually exporting, converting, and uploading indicators.
• Responder update policies: Administrators can manage automatic Responder updates through policy groups and filters, including policy scheduling, asset match counts, and per-asset update status visibility. This helps teams keep Responders current while controlling update rollout for sensitive or operationally constrained assets.
• Disk I/O Priority for tasks and policies: AIR now supports a Disk I/O Priority resource limit for policy and task configurations. Analysts can tune collection and response activity to reduce performance impact on critical assets during active investigations.
• Safer Active Directory disable flow: Disabling Active Directory integration now includes clearer impact information and an explicit keep-or-remove decision for AD-synced assets. This reduces the risk of unintended Responder uninstall activity and gives administrators better control during directory integration changes.
• Expanded Windows SMB event coverage in acquisition profiles: Full, Quick, and Compromise Assessment profiles now include additional SMB-related Windows event records. This gives investigation teams stronger visibility into file-sharing, authentication, and SMB-related activity during evidence collection.
• PostgreSQL 18 support for on-prem deployments: AIR now supports PostgreSQL 18 for on-prem environments with version 5.23. After upgrading AIR, administrators can schedule the PostgreSQL upgrade separately during a planned maintenance window, helping ensure continued compatibility, performance, scalability, and support for future AIR releases.
• Dual Go runtime support for Windows Responders: AIR now automatically delivers a Go 1.26-based Responder to Windows 10 and later devices, while earlier Windows versions continue to receive the Go 1.20 build. Both variants provide the same functionality, improving security scanner compliance without affecting legacy OS support or requiring configuration changes.

New Features & Improvements

Threat Intelligence and Hunt/Triage

Cyber Threat Intelligence (STIX/TAXII Feed) Integration

AIR now supports TAXII Feed Integration for connecting to TAXII 2.x compliant threat intelligence servers. Teams can configure a feed with a server URL, authentication method, collections, sync interval, and conversion preferences. AIR then pulls STIX indicators and converts supported indicators into investigation-ready Hunt/Triage content.

The feature supports public and authenticated feeds, collection discovery, manual and scheduled sync, sync logs, indicator browsing, confidence thresholds, and managed or snapshot ownership modes. Managed feeds regenerate system-owned rules as indicators change, while snapshot feeds allow analysts to capture a point-in-time set of indicators without modifying or deleting previously generated rules.

For analysts, this reduces the time between receiving intelligence and using it in an investigation. File hashes, domains, URLs, registry keys, mutexes, process names, direct YARA, and direct Sigma indicators can be transformed into YARA, Sigma, and osquery rules according to the selected conversion configuration.

To use the feature, open the Integrations area, create a TAXII feed, test the connection, select collections, choose the rule generation settings, and save the feed. After sync, generated Hunt/Triage rules become available for investigation workflows according to the configured ownership mode and rule settings.

Expanded SMB Event Log Coverage

Windows acquisition profiles now include expanded SMB event coverage. Full, Quick, and Compromise Assessment profiles have been updated with SMB client, SMB server, and Security channel event selections that preserve higher-value SMB investigation signals while limiting noise in faster profiles.

This improvement helps analysts review file-sharing, share modification, authentication, and SMB security activity during post-incident investigations. It is especially useful when investigating lateral movement, remote access to shared resources, and suspicious file access patterns.

The Full profile includes the broadest researched event coverage, Quick includes a security-focused subset, and Compromise Assessment includes the strongest low-noise indicators. Existing event selections remain unchanged.

Investigation Hub and Case Workflows

Case Task Import Status Visibility

Case task listings now reflect Investigation Hub import status more accurately. When task data is imported into Investigation Hub, AIR mirrors the status into the task assignment metadata used by case task grids.

This gives analysts clearer visibility into whether task results have been imported and are available for review in Investigation Hub, reducing confusion when evidence appears in Investigation Hub but the case task list previously showed the import status as not applicable.

Assets, Responders, and Task Execution

Responder Update Policies

AIR now provides grouped Responder update policies in Settings. Administrators can configure automatic update behavior through policy cards, filters, schedules, matching asset counts, and a unified save workflow.

The asset detail view now shows resolved Responder update status, helping operators understand whether an asset receives automatic updates, which policy applies, and what action may be needed. This improves update governance across large environments where different asset groups require different rollout behavior.

A typical use case is to define a policy for a tagged or filtered group of production servers, apply a specific update window, and review matched assets before saving. New assets that match the policy criteria can then inherit the intended update behavior without a manual bulk operation.

Disk I/O Priority for Task Resource Control

Task and policy configuration now includes Disk I/O Priority. The priority can be set from Lowest to Highest, with Medium as the default. AIR passes the selected priority to the Responder for supported task types.

This gives analysts and administrators more control over the runtime impact of investigation tasks. During active response, teams can lower priority for business-critical systems or increase priority when rapid evidence collection is more important than background resource usage.

The setting is available in task advanced options, policy resource limits, and interACT shell task options. Existing configurations that do not include the field continue to rely on Responder defaults.

Dual Go Runtime Support for Windows Responders

To improve security scanner compliance while maintaining compatibility with older Windows operating systems, AIR now delivers Windows Responders with the appropriate Go runtime based on the target OS version.

Starting with Responder 3.0.0, Windows 10 and later devices receive a Responder built with Go 1.26, while earlier Windows versions continue to receive a Go 1.20 build. Both variants provide the same Responder package, functionality, and feature set—the only difference is the embedded Go runtime.

This enhancement addresses vulnerability scanner findings related to older Go runtime versions (such as VOC-2709) without requiring customers to choose between modern security compliance and legacy operating system support.

Responder selection is performed automatically by AIR:

Windows 10 and later: Latest Responder (Go 1.26)
Earlier than Windows 10: Legacy Responder (Go 1.20)

No additional configuration or deployment changes are required. Both Latest and Legacy Responders continue to be fully supported.

As part of this change, the Windows MSI installer size increases from approximately 58 MB to 106 MB due to the inclusion of the newer Go runtime. Linux and macOS support for dual runtime delivery will be introduced in a future release.

Administration and Platform Operations

PostgreSQL 18 Support is Now Available for On-prem Deployments

After upgrading AIR to v5.23, administrators can upgrade PostgreSQL separately at a time that fits their maintenance schedule by following the PostgreSQL Upgrade Guide. The database upgrade is not performed automatically and requires planned downtime, during which AIR will be temporarily unavailable.

PostgreSQL 18 will become AIR’s supported database configuration at the end of August, so on-prem customers are strongly encouraged to plan their upgrade accordingly.

Before you begin, we recommend that you:

• Wait at least 24 hours after upgrading AIR.
• Close inactive cases.
• Create an AIR Backup.
• Review the PostgreSQL Upgrade Guide.

Safer Active Directory Disable Flow

Disabling Active Directory integration now provides a safer and more explicit flow. AIR shows an impact summary, including total affected assets and how many have Responders installed, before the operator chooses whether to keep or remove AD-synced assets.

This reduces the operational risk of disabling directory synchronization. Administrators can stop synchronization without unintentionally removing managed assets or uninstalling Responders, and can make a deliberate choice when cleanup is required.

Setup Wizard Proxy and Trusted CA Validation

The setup wizard now supports proxy validation before installation. Proxy and trusted CA checks use the same connectivity validation approach as the post-install Settings experience, helping administrators verify outbound connectivity earlier in the deployment process.

This improvement helps reduce setup friction in restricted environments. Administrators can validate proxy settings during installation and correct connectivity issues before completing the AIR deployment.

Backup History Encryption Column

The Backup History table now includes an Encryption column. The column shows whether each backup was encrypted, using the existing backup data already displayed in Backup Details.

Security, Governance, and Authorization Improvements

Git Repository Organization Scope Enforcement

Git Repository API endpoints now enforce organization scope more consistently. Users and API tokens with Git Repository privileges can only access repositories associated with organizations they are authorized to use.

This strengthens governance for customers using Git repositories to import or synchronize investigation content. Filtering, retrieving, creating, updating, deleting, syncing, and viewing logs now apply stricter organization relevance checks.

Privilege Dependency Validation

AIR now validates privilege dependency definitions more strictly. Every catalog privilege must have an explicit dependency entry, even when it has no dependencies.

This helps administrators configure roles more consistently. When a privilege requires a related view or supporting privilege, role configuration can auto-select or validate the required dependency instead of leaving users with incomplete access that causes screens or actions to fail.

Bug Fixes

• Expired task assignments now finalize parent task status. When assignments expired after remaining in Assigned or Processing for an extended period, parent tasks could stay stuck in Assigned or Processing even though no active assignments remained. AIR now treats expired assignments as settled for task completion accounting, recalculates the parent task, and includes a self-heal sweep for historical stuck tasks. This helps administrators and SOC teams identify whether investigation work is actually active.
• Retry Upload now preserves custom evidence repository folder naming. Retried uploads no longer land at the root of the evidence repository when custom evidence collection naming is configured. AIR now uses the original acquisition context so retried evidence follows the expected folder hierarchy.
• Evidence repository validation delay reduced in acquisition workflows. Selecting an unreachable repository in the acquisition customization step now times out faster and shows the existing inaccessible-repository warning instead of pausing for about 10 seconds or advancing without feedback.
• Global Search and Grid Search consistency improved. Grid search behavior has been corrected so users are less likely to miss records that are returned by Global Search for the same keyword.
• Case task import status now reflects imported Investigation Hub data. Case task pages no longer show imported task data as not applicable when the data is available in Investigation Hub.
• Asset resource usage no longer shows misleading zero-based values while metrics are pending. Newly registered assets now show a pending usage state until CPU, memory, and disk metrics arrive, instead of displaying values such as 100% CPU free or 0 B memory free.
• Production UI blank page after build upgrade fixed. A loading issue that could cause the AIR Console UI to display a blank page in production and staging builds has been resolved.
• All export functions now work behind proxied environments. Export preflight handling now uses a standard success response instead of a non-standard status code that could be rewritten by edge infrastructure. The UI now starts downloads on standard successful preflight responses and shows an error when export preflight fails.
• GCP account creation and verification now work with proxy and trusted CA configurations. AIR corrected the GCP client transport behavior that could fail with plugin metadata or response parsing errors during account creation.
• Azure remote command errors now show the real service message. Azure VM command failures no longer surface JSON parsing errors when the cloud service returns a plain-text error. Operators now see the actionable Azure error message, such as when a VM must be running before a command can execute.
• Full Text Search task flow now validates mandatory case selection consistently. AIR now shows the required case warning when progressing through the Full Text Search task flow without selecting a case, matching the Start action behavior.
• Responder update default schedule drawer now respects disabled time frames. The Default policy schedule drawer no longer shows “Set Time Frame” enabled when the backend explicitly has the time frame disabled.
• Forward proxy handling for internal processor traffic corrected. When a forward proxy is enabled, trusted Console-to-processor traffic for internal infrastructure now bypasses the proxy for private network targets. This prevents processors from appearing offline and disk image actions from being disabled when the proxy cannot resolve internal processor hostnames.
• Push-type task assignments now fail correctly when processor delivery fails. Disk image and DRONE-related assignments no longer remain in Assigned indefinitely after all processor assignment retries fail. AIR now marks affected assignments as Failed and rolls up the parent task status.
• Processor-side cleanup during asset deletion now reaches trusted internal processors. Asset deletion cleanup calls now use the trusted private-network path, preventing orphaned processor-side files when internal processor hosts were blocked by outbound safeguards.
• PST evidence import no longer blocks the main application event loop. PST import now runs asynchronously with streaming and bounded processing. This prevents long event-loop stalls, Redis connection storms, and health check failures in shared SaaS environments while still surfacing import failures to the UI.
• Worker processes now initialize white-labeling configuration. Task delivery failures caused by missing white-labeling configuration in worker processes have been resolved.
• Asset and case association lists now handle empty scopes correctly. Asset or Responder case tabs no longer show all organization cases when the asset has no related case assignments. AIR now returns an empty list when the related case scope is explicitly empty.
• interACT command-result downloads now require read permission. AIR now enforces the appropriate interACT read privilege before users can download persisted command output files. Enumerate-only users can no longer reach command-output resolution paths.
• Git Repository organization access tightened. Git Repository operations now reject access to repositories or organization scopes outside the caller’s assigned organizations.
• Gaps in case, task, and assignment counts were reduced for large environments. Task visibility queries and count retrieval were optimized to reduce expensive repeated list and count calls, especially for scheduled task views in large tenants.