What’s New?

• Retry failed task assignments without recreating tasks. Analysts can now retry eligible failed task assignments from task and asset workflows. This helps investigation teams re-run failed collection or analysis work on affected assets without rebuilding the original task, preserving operational context and reducing response time.

• Responder update workflows are easier to manage at scale. Responder update tasks can now be named and opened directly from tag action menus. This improves staged rollout tracking across large asset groups and helps administrators target updates more confidently.

• Advanced auto asset tagging conditions are available. Auto asset tagging rules now support additional negative and pattern-based operators such as “does not contain,” “does not start with,” and regex-style matching. This helps security teams classify assets more accurately in complex environments.

• Linux file system enumeration can be configured to include or exclude network-mounted file systems. Acquisition workflows now include an optional setting to include or exclude mounted network file systems when collecting Linux file system enumeration data. This gives analysts broader visibility when relevant artifacts may exist on mounted storage while keeping the default behavior conservative.

New Features & Improvements

Investigation Hub

Clearer Search Results and Failure Visibility

Investigation Hub now distinguishes between a successful search that returns no results and a search that could not complete because of a backend error, timeout, connection issue, or permission problem. Evidence grids now display an error row when data loading fails instead of showing an empty “No Records Found” state.

Global search also tracks success, partial success, and failure states. If some evidence categories fail while others succeed, analysts can still review partial results and see that the search did not fully complete.

Improved Large Evidence Detail Rendering

Evidence detail panels now handle very large array fields more efficiently. AIR deduplicates repeated values, shows occurrence counts, and paginates large lists instead of rendering every item at once.

This improves responsiveness when reviewing evidence items with thousands of values, such as matched strings or large parsed fields. Analysts can still copy, filter, and open values in relevant tools while avoiding browser freezes during evidence review.

Evidence Detail Label Localization

Network-related fields in the Investigation Hub’s Evidence Details view now display properly formatted labels — such as “IPv6 Address,” “IP Address,” “DHCP Enabled,” and “DHCP Server” — instead of auto-generated casing. The system resolves labels through translations first and falls back to generated labels only when no translation exists, improving readability for analysts reviewing network adapter data during investigations.

This improves readability in evidence detail views and helps analysts interpret network adapter data more quickly during asset and network-focused investigations.

Asset and Responder Operations

Retry Failed Task Assignments

AIR now supports retrying eligible failed task assignments without creating a new task. Users can retry a single failed assignment, retry all failed assignments from a task detail view, or retry eligible failures from bulk selections.

Retry applies only to failed assignments that are safe to re-run. AIR filters out ineligible items and provides confirmation before the retry starts. After a retry is triggered, the assignment returns to active processing and follows the normal task lifecycle.

This improves response efficiency when collection or analysis fails because of a temporary condition. Analysts can recover failed work while keeping the original task context and history.

Custom Names for Responder Update Tasks

Responder update tasks can now use a custom task name. If the user leaves the task name empty, AIR continues to generate a default name automatically.

This is useful for staged rollout plans where administrators update different asset groups over time. Meaningful task names make it easier to distinguish rollout phases, review progress, and communicate update status to operations teams.

Update Responder from Asset Tags

The tag action menu now includes an Update Responder option. When selected, AIR opens the responder update workflow pre-filtered to assets with the selected tag.

This supports customers who use tags to manage responder update waves. Administrators can target tagged asset groups directly without manually rebuilding filters in the Assets view.

CPU Core Limit Controls in Task and Policy UI

CPU Core Limit settings are now visible in policy limitations, task advanced options, and interACT shell task resource limits where supported by the Responder. The setting works alongside existing CPU percentage controls.

This gives administrators more control over how resource-intensive tasks behave on critical assets.

Evidence Collection and Acquisition

Optional Linux Network-Mounted File System Enumeration

Acquisition workflows now include an optional File System Enumeration Configuration setting for Linux. When enabled, AIR includes mounted network file systems such as network shares during Linux file system enumeration.

The setting appears when the selected acquisition profile includes Linux file system enumeration. It remains disabled by default to avoid unexpected collection from mounted network locations.

This gives analysts control when relevant artifacts may reside on mounted storage, while preserving predictable default acquisition behavior for standard investigations.

Improved Disk Image Parse Evidence Flow

The disk image File Explorer “Parse evidence” flow now preserves selected paths and related context when opening Quick Start. AIR also adjusts date and size defaults for path-scoped runs so explicitly selected files are not excluded by broad profile defaults.

This improves analyst workflows when parsing evidence from selected disk image paths. The selected files remain in scope, reducing manual reconfiguration and avoiding missed artifacts due to inherited filters.

Backup Encryption Status in Backup Details

The Backup Details view now shows whether encryption was enabled when each backup was created. New backups store this value at the time the backup is queued.

Existing backup records created before this release show the status as Unknown. This gives administrators better visibility into backup posture without requiring additional support checks.

Hunt/Triage and Rule Management

Improved Rule Validation Reuse

Hunt/Triage, acquisition, and interACT command validation now share common validation behavior for osquery syntax and schema checks. This improves consistency when users validate rule content or run query-based investigation actions.

For analysts, this means unsupported or invalid query content is more likely to fail early with clearer feedback instead of failing later during task execution.

Optimized Git Repository Rule Sync

Git repository synchronization now fetches repository archives for supported providers and reads file content locally during a sync. This significantly reduces the number of provider API calls required for large rule repositories.

For teams managing large Hunt/Triage rule repositories, initial syncs are less likely to hit provider rate limits and produce fewer skipped-file messages. If archive retrieval fails, AIR falls back to the existing per-file behavior.

Auto Asset Tagging

Additional Rule Operators

Auto asset tagging rules now support additional operators, including negative conditions and regex-style matching for supported fields. Examples include hostname does not contain, hostname is not, hostname does not start with, and related negative match patterns.

This helps administrators build more precise asset classification rules. For example, a rule can include assets whose hostname starts with a regional prefix while excluding assets whose hostname contains a specific platform or workload marker.

Predefined Auto Asset Tagging Rules Are Restored and Protected

AIR now verifies predefined auto asset tagging rules during startup and restores any missing predefined rules. The system also protects predefined rules from edit and delete actions while still allowing administrators to enable or disable them.

This keeps out-of-the-box tagging behavior consistent across environments and reduces the risk of losing predefined rules during maintenance or cleanup. Custom customer-created rules remain unaffected.

interACT

More Reliable interACT Session Handling

interACT run, cancel, and close operations now include asset readiness checks and improved handling for stale or warming sessions. AIR can retry during a readiness window and return clearer errors when a session is not ready.

This improves live-response reliability and helps analysts understand whether a command failed because of validation, asset readiness, or session availability.

Enterprise Connectivity and Administration

Proxy Exclusion List

Proxy settings now support an exclusion list. Administrators can define destinations that should bypass the configured proxy and be reached directly.

The exclusion list supports hostnames, wildcard domains, IP addresses, and CIDR ranges. This helps organizations where internet-bound traffic must use a proxy, but internal services such as evidence repositories must be reached directly.

The exclusion list is available in the Proxy settings UI and is applied to outbound Console connections that use the managed transport configuration.

Enhanced Proxy Testing and Troubleshooting

AIR now includes a proxy connection test with structured diagnostics. Administrators can test connectivity to a target URL without saving settings and review clearer status, duration, and categorized error information.

This improves troubleshooting in environments with strict network controls, SSL inspection, proxy authentication, or internal certificate authorities. The setup wizard also supports proxy testing before installation is completed.

Trusted CA Save Without Validation

Trusted CA certificate import now supports saving a certificate without requiring live validation. This helps proxy-only or isolated deployments where the certificate is valid but the validation target is not directly reachable.

AIR also provides clearer validation feedback and better handling for proxy CA removal, reducing the need for manual configuration changes during troubleshooting.

Bug Fixes

• Responder update task scope now respects the selected Issue filter. In a customer-reported production case, using “Select all records” with an Issue filter during a Responder update could widen the task to all updatable assets in the organization while the confirmation dialog showed the filtered count. AIR now intersects the user’s Issue filter with valid update-related issues and rejects filters that contain no updatable issue. This prevents unintended large-scale Responder update rollouts.

• Bulk action confirmation counts now preserve “No” filters. A customer-reported issue caused stats requests to drop boolean false filters such as Is Server = No, inflating confirmation counts for bulk actions. AIR now serializes false-valued filters correctly so confirmation dialogs and bulk action counts match the filtered asset set.

• Update Responder Version now closes the asset action menu. When opened from an asset detail action menu, the update panel no longer leaves the dropdown visible over the page.

• Asset update exclusion match counts now include only responder-managed asset types where applicable. Auto Responder Update Exclusion previews no longer count disk images, cloud assets, or other non-responder asset types when evaluating responder update exclusion rules.

• IP Restriction no longer marks the application container unhealthy. The internal loopback health check for application information is now exempted from IP Restriction only when it originates from loopback. External restricted clients remain blocked.

• OIDC SSO attribute mapping now persists correctly in the settings view. OIDC claim mappings are returned with the provider configuration after refresh, so administrators can confirm and maintain custom attribute mappings from AIR.

• OIDC SSO role claims now support single-string values. AIR now treats a single role claim string as a one-item role list, improving compatibility with identity providers that emit one role as a string instead of an array.

• Investigation Hub flags filtering now preserves organization scope. A crafted filter could bypass the intended organization boundary when querying custom flags. AIR now groups client filters so organization scoping remains mandatory.

• Triage tag deletion now enforces organization authorization. AIR now checks the owning organization before allowing triage tag deletion across private, public, and legacy routes.

• interACT command-snippet tag deletion now enforces organization authorization. AIR now resolves the tag’s organization before update or delete operations, preventing cross-organization changes when a foreign tag ID is known.

• User update authorization now protects higher-tier administrators. A lower-tier administrator can no longer downgrade a Global Admin or Organization Admin through user update routes and then delete the account.

• User group mutation responses no longer expose sensitive member fields. Create and update responses now return sanitized user group data, matching the safe read-path projection.

• Portable disk image package handling is hardened. Portable disk image packages no longer include repository credentials or license data, remote asset package creation is rejected, and downloads enforce privilege and organization ownership checks.

• Off-network share links now require a signature. Anonymous off-network package share links now include and verify a signed parameter before serving a file. Authenticated download behavior is unchanged.

• Package download audit events are now scoped to the owning organization. Portable and off-network package download events no longer appear as system-wide audit entries visible to unrelated organization administrators.

• Organization deletion audit visibility is restored. Organization deletion events are now scoped so the audit entry remains visible after the organization is deleted, while still recording the deleted organization’s name and identifier.

• Chained audit and syslog entries can be suppressed. AIR adds separate settings to suppress chained log entries created by indirectly affected entities, reducing noise during high-volume cleanup operations such as large asset deletions.

• Investigation report PDF generation no longer loads remote subresources. Report rendering now allows only local file and embedded data resources during PDF generation, preventing unexpected outbound requests from report content.

• Investigation report logos now reject remote URLs and unsupported values. The company logo field now accepts only supported embedded image data within size limits. Existing URL-based logo values must be replaced by uploaded images.

• Outbound redirect validation now blocks disallowed IP literal redirects. AIR validates each redirect hop for outbound HTTP requests so redirects cannot bypass network destination controls.

• Two-factor verification now includes bounded retry and replay protection. AIR now rate-limits failed two-factor and recovery attempts and prevents reuse of an already accepted time-based code within its validity window.

• Authentication endpoints now include per-source rate limiting. Login and forgot-password flows now include an additional per-source limit to reduce targeted account lockout noise while preserving existing per-account protections.

• Password policy has been strengthened. New local and API password paths now reject common weak passwords and support longer passphrases. Existing login behavior is unchanged so current users are not locked out by the policy change.

• Public JavaScript bundles no longer include all Userflow environment tokens together. Build-time environment configuration now includes only the token required for the running environment, reducing unnecessary exposure of unrelated environment identifiers.

• Organization and user group names now reject unsafe markup. AIR enforces consistent safe-name validation and prevents raw HTML-like markup from being stored in these administrative fields.

• Client-side CSV exports now defang formula-leading values. User list, imported user, evidence, task, file explorer, and report-related CSV exports now route through a shared safe export helper.

• Investigation Hub evidence pages with high finding fan-out no longer fail with server errors. AIR now deduplicates lookup keys before building comment queries, preventing excessive query bindings on evidence categories with many related findings.

• Investigation Hub Flag “Is blank” and high-volume evidence views are more stable. Query and rendering improvements reduce failures and improve feedback when large findings or evidence sets are involved.

• Task execution logs are visible after ingestion in environments using the refactored pipeline. The refactored ingestion path now populates the same task execution log data used by the Investigation Hub navigation tree.

• Temporary directory cleanup no longer follows symlinks outside the temp directory. The cleanup job now treats symlinks as links and verifies deletion paths remain inside the intended temporary directory.

• Trusted CA and proxy validation errors are clearer. Proxy-only and custom CA environments now receive improved validation handling, better error categories, and a save-without-validation option where live validation is not possible.

• S3-compatible evidence repository validation works more consistently with internal certificates and proxy settings. Outbound clients now honor configured proxy and trusted CA settings more broadly, improving validation and repository-related workflows in enterprise networks.

• RPM responder deployment commands now include the option required for unsigned packages. Generated RPM installation guidance avoids manual intervention when package signature checks would otherwise block installation.

• MITRE ATT&CK auto-update save confirmation is restored. Enabling auto-update now shows the expected confirmation and prevents form submission paths from bypassing the warning.

• Backup Details now displays encryption status correctly for new backups. Backup records now capture whether encryption was enabled when the backup was created.

• Disk image acquisition profile creation provides clearer validation and selection behavior. Inline profile creation now shows field errors correctly, keeps the drawer behavior consistent, and automatically selects a newly created profile.

• SDK acquisition task typing has been aligned with the documented response shape. The generated SDK package build no longer fails because of a mismatched assigned-task response type.