What’s New?

• Stale Asset Policies for automated asset hygiene. Administrators can now define policy-based Unreachable thresholds and optional cleanup actions for stale assets. This helps investigation teams keep asset inventories accurate, reduce noise, and automatically reclaim capacity when responders have not connected for a defined period. Important licensing change: Assets with an installed Responder will consume a license even when they are Unreachable. Administrators should take this into account when defining stale asset cleanup policies and managing license capacity. For configuration details and additional guidance, see the Knowledge Base.

• Threat intelligence operationalization with TAXII and manual STIX import. AIR can now support manual STIX imports for TAXII feeds, allowing analysts to upload STIX bundles and convert indicators into investigation-ready Hunt/Triage content.

• Console-level Asset Tag Catalog. Administrators can now define shared asset tags at Console level and make them available across organizations. This improves consistency for MSSPs and large teams that need common investigation labels without recreating tags in every organization.

• Expanded AI evidence visibility. AIR now adds AI model inventory support to acquisition profiles and Investigation Hub, helping analysts identify local AI model stores and related artifacts during security investigations.

• Tamper Detected notifications. Responder tampering activity, such as responder stop, removal, or configuration changes, can now be surfaced through configurable notifications. This gives administrators faster awareness of activity that may affect evidence collection or response readiness.

• API V2. Binalyze AIR now includes a redesigned API v2 surface built for automation-first integration across multi-tenant environments. API v2 introduces consistent organization-scoped operations, a unified filter and pagination contract, and safe-by-default mutation handling with dry-run support across write endpoints. v2 is additive and v1 is still fully supported, this is not a migration and there is no deprecation. Comprehensive API reference, guides, and interactive request examples are available in the AIR API v2 Documentation.

New Features & Improvements

Asset & Responder Management

Stale Asset Policies

Stale Asset Policies introduce configurable Unreachable thresholds and optional cleanup actions for assets. Administrators can create custom policies, set how many days of inactivity should mark an asset as stale, and choose whether AIR should take no action, purge the asset from the Console, or purge and uninstall the responder when the asset reconnects.

This feature is designed for teams managing large fleets where inactive assets can create operational noise. By using policy order and filters, administrators can apply different thresholds to different asset groups while keeping a default policy for the rest of the environment.

The feature also includes removal history and CSV export, giving administrators a record of assets removed by automated cleanup. This supports operational review and helps teams understand which assets were removed, when they were removed, and which policy was responsible.

Stale Asset Policies also update the meaning of Managed, Off-network, and Unmanaged status. Being unreachable no longer removes an installed responder from Managed status or license counting by itself. Cleanup policies become the intended method for reclaiming inventory and license capacity from stale assets.

Console-Level Asset Tag Catalog

The Asset Tag Catalog now supports Console-level tags. A tag with All Organizations scope is available across existing and future organizations, while organization-specific tags remain supported.

This is especially useful for MSSPs and large security operations teams that need consistent labels across customers, business units, or environments. Administrators can promote tags to Console level, resolve naming conflicts with confirmation, and keep shared taxonomy consistent across the Console.

Auto Asset Tagging can reuse Console-level catalog tags instead of creating duplicate organization-specific copies, which improves consistency in asset classification and investigation filtering.

Evidence Collection & Investigation Hub

AI Model Evidence Collection

AIR now includes AI model inventory collection in acquisition profiles for supported platforms. The new AI Models artifact source can be included in Full, Compromise Assessment, and AI Evidence Collection profiles.

Investigation Hub displays collected AI model inventory in the evidence navigation and provides row-level details with related task execution logs. This helps analysts identify local AI model stores and AI-related runtime evidence during security investigations.

The collection focuses on inventory and metadata rather than copying large model weights. This gives analysts useful visibility while keeping collection size and operational impact controlled.

Selected Evidence Counts on Acquisition Profile Tabs

Device Acquisition Profile category tabs now show live selected-item counts. Analysts can see how many evidence items are enabled under categories such as System, Memory, Network, Event Logs, Disk & File System, Applications, AI, Custom Content, and osquery.

This improves profile review and reduces the need to open each category to confirm configuration. Counts update as analysts select or deselect artifact sources.

Threat Intelligence, Hunt/Triage & DRONE

Manual STIX Import for TAXII Feeds

TAXII Feeds now support Manual STIX import as a source type. Analysts can create a manual feed and upload a STIX 2.x bundle or JSON object array instead of connecting to a remote TAXII server.

Imports are processed in batches, progress is shown to the user, and a single import produces a sync log with added, updated, skipped, and processed indicator counts.

This improves threat intelligence workflows for teams that receive STIX bundles through offline, partner, or restricted channels. Analysts can operationalize those indicators into Hunt/Triage rules without waiting for a live TAXII connection.

TAXII Feed Rule Source Handling

Hunt/Triage rules generated from TAXII feeds now retain their source correctly during predefined rule reseeding. TAXII-synced rules are preserved as imported content rather than being removed as if they were shipped predefined rules.

The Hunt/Triage Rules grid also identifies TAXII-synced rules as TAXII Feed instead of Manual. This helps analysts distinguish rules created by threat intelligence ingestion from manually authored or Git-synced content.

interACT

interACT Wait-Time Guidance

When an analyst starts an interACT session, AIR now shows an estimated wait time based on the current responder visit interval. The UI also indicates when the wait is taking longer than usual.

This gives analysts better feedback while AIR waits for the asset to connect. If the target asset is offline, the UI shows that state instead of displaying a misleading estimate.

The estimate is informational, not a hard maximum. A busy Console or an offline asset can still make the wait longer.

Settings & Administration

API v2

Binalyze AIR now includes a redesigned API v2 surface built for automation-first integration across multi-tenant environments. API v2 introduces consistent organization-scoped operations, a unified filter and pagination contract, and safe-by-default mutation handling with dry-run support across write endpoints.

Key surfaces include asset management, acquisition and triage task orchestration, interACT remote shell sessions with longer synchronous run windows, Investigation Hub SQL queries with evidence flagging, case and task lifecycle management, and baseline comparisons. A new Fleet predefined role supports least-privilege API token access for automation integrations.

API v2 is additive and v1 is fully supported — this is not a migration and there is no deprecation. Existing v1 public API endpoints remain available and unchanged, including evidence repository, policy, and audit trail access, which have not yet moved to v2.

Comprehensive API reference, guides, and interactive request examples are available in the AIR API v2 Documentation.

Tamper Detected Notifications

AIR can now generate Tamper Detected notifications when a responder reports that it was stopped, removed, or had its configuration changed.

These notifications are available in the notification registry, header popover, and notification history. Users can configure notification preferences from Account > Notification Settings.

This helps administrators respond faster to activity that may affect responder integrity or the continuity of evidence collection.

Tenant-Specific Storage Support for CMEK Deployments

Tenant infrastructure can now be configured to use a dedicated storage bucket and optional customer-managed encryption key. This supports deployments that require tenant-specific encryption controls.

The application continues to use a single configured storage target, while the infrastructure layer controls the bucket and key used by that tenant.

Performance & Scalability Improvements

Responder Request Processing Optimizations

High-frequency responder request validation has been optimized to reduce Console CPU usage on large fleets. AIR now uses compile-once validation on selected responder request paths while preserving the same accepted request shapes and error behavior.

Responder security-token checks now use a dedicated cache path that reads only the token required for authentication, instead of loading full asset records. This reduces cache traffic and improves throughput on responder-heavy deployments.

Additional optimizations reduce unnecessary settings and SSO lookups on common request paths, remove inactive production request logging overhead, and speed up repeated version parsing used in responder update checks.

Bug Fixes

• Policy priority drag-and-drop now works again. Policy rows in Settings > Policies can be reordered with the mouse, and the new order is saved correctly. This restores policy precedence management for administrators who rely on policy order to determine the effective configuration applied to matching assets.

• Manual Responder Update warnings now match the selected assets. The conflict warning shown before a manual responder update now counts running tasks only on the selected assets, not across all manually updatable assets in the organization. This prevents misleading warnings when an operator updates one idle asset while other assets have active tasks.

• Investigation Hub Timeline keeps its scroll position after flagging. Flagging or unflagging a Timeline event no longer resets the view to the top. Analysts can continue reviewing events without losing their place in long timelines.

• The update-check failure notification no longer claims an incorrect 48-hour window. The notification text now states that no connection to the update server could be established, without referencing a duration that the backend does not track.

• Closing a case no longer redirects to the permission page when Close Report is disabled. When Case Dashboard is enabled but Case Close Report is disabled, closing a case now keeps the user on the case instead of loading a report route that the user cannot access.

• Case Dashboard asset counts now align with Case Assets. The Case Dashboard and Closure Report summary now use assignment-linked case asset counts, matching the count shown in the case navigation. The Asset Overview preview remains unchanged.

• License in-use count is refreshed when a purged asset reconnects. When a stale asset is purged and the responder later reconnects, AIR now updates license usage correctly so the in-use count reflects the restored managed asset.

• LDAP group filters now work with backslash paths. Group filters using paths such as domain and child group combinations now match correctly. This fixes cases where valid LDAP group filters returned zero assets because backslashes were escaped for the wrong comparison type.

• The Default Stale Asset Policy drawer can calculate match counts. Empty filters used by the default catch-all policy are now accepted for preview, while custom policies still require valid filter conditions.

• Last Seen is no longer offered as a Stale Asset Policy filter condition. The Stale Asset Policy threshold already uses asset activity time, so removing Last Seen from policy filter predicates prevents confusing or conflicting policy definitions. Save and delete messages now also remind administrators that Unreachable status refreshes within approximately five minutes.

• TAXII-synced Hunt/Triage rules are preserved during predefined rule reseeding. Rules generated from TAXII feeds are no longer removed on Console bootstrap, and their source is shown correctly as TAXII Feed.

• DRONE Analyzer Profile MITRE ATT&CK search now finds rules by name. The MITRE ATT&CK view now searches nested rule and analyzer metadata, not only tactic and technique names.

• MITRE ATT&CK ruleset downloads are more reliable in distributed SaaS deployments. AIR now serves versioned rulesets and DRONE catalogs from shared storage so all Console nodes use the same artifact source.

• Versioned MITRE ATT&CK contract fixtures were aligned. The versioned responder download contract now uses the expected version key and response hash behavior, improving compatibility between Console and responder verification.

• EndpointIsolationStatusUpdatedEvent is now published from modern responder state updates. Isolation status changes reported through responder state requests now emit the same event as other isolation paths, allowing isolation-related automations and status-dependent flows to progress correctly.

• Theme color-scheme handling was corrected. Browser-native UI elements such as scrollbars now follow the selected light or dark theme more consistently.

• Health check handling was fixed for tenantless requests. Tenantless liveness requests no longer fail when tenant context is intentionally absent. This improves operational health checks without changing authenticated tenant behavior.

• Cloud and tenant deprovisioning behavior was improved. AIR now handles scheduled-deleted secrets and duplicate resource identifiers more safely during tenant investigation database deprovisioning, reducing false failure reports and retry loops after successful cleanup.