What’s New?

• Multi-channel operational notifications help teams respond faster. AIR now supports notification delivery through email, Slack, Microsoft Teams, and Mattermost in addition to in-app notifications. Analysts and administrators can route important task, case, asset, system, and Investigation Hub events to the channels where response teams already work, reducing the chance that critical updates are missed during an active investigation.
• Advanced expression-based filtering improves asset targeting. Analysts can now build nested asset filters with AND/OR logic, text matching, date and number comparisons, tag conditions, regular expressions, blank/not blank checks, and CSV-imported values. The same filter logic applies across lists, counts, exports, presets, task assignment, and bulk actions, helping investigation teams target exactly the right asset set with more confidence.
• Box is now available as an evidence repository destination. AIR can save collected evidence to Box repositories using supported Box authentication methods. This gives teams another managed destination for investigation evidence while preserving the existing repository selection experience in acquisition workflows.
• AI application artifact collection is now available. Acquisition profiles now include AI application artifact sources across Windows, Linux, and macOS. A new predefined AI Evidence Collection profile helps analysts collect relevant local AI tooling artifacts without building custom profiles from scratch.
• Responder update visibility gives administrators clear update status across the fleet. AIR now records and displays Responder update state, update history, retry status, exclusion status, and the reason an asset is waiting, skipped, or failed. This helps administrators understand update posture without relying on temporary logs or repeated manual checks.
• Asset Tag Catalog enables tag governance before assets are assigned. Administrators can now create, rename, delete, and manage asset tags independently from asset assignment. Auto Asset Tag rules also create their catalog tags when saved, so defined tags are visible immediately even before a rule matches an asset.
• Breaking change for API users. Asset-filter bulk API call now includes an assertions guard: an upper bound on how many assets may be affected. Now assertions is required on filter-based bulk endpoints, which was previously optional. Integrations should be updated accordingly, with setting a threshold that matches safety limits. Details can be found on http://docs.binalyze.com.

New Features & Improvements

Notifications and Automation

Breaking change for API users

To improve operational safety for API-driven bulk actions, filter-based asset endpoints now require an assertions guard that sets the maximum number of assets a request may affect.

API consumers must include { “assertions”: { “failIfNumberOfAssetsGreaterThan”: NUMBER } } in requests to supported bulk endpoints; if the filter matches more assets than the specified threshold, the request will fail without executing.

This protection applies across operations such as acquisition, triage, full-text search, auto asset tagging, baselining, reboot/shutdown/isolation, log retrieval, version updates, and uninstall/purge actions. This is a breaking change for API integrations; UI workflows are unaffected.

Customers and partners should update their integrations, choose thresholds appropriate to their operational safety limits, and validate changes in a non-production environment before rollout. See the KB article for the full list of affected endpoints and http://docs.binalyze.com for payload details.

Multi-Channel Notification System

AIR now supports a broader notification model across in-app notifications, email, Slack, Microsoft Teams, and Mattermost. This allows cybersecurity teams to receive operational updates in the communication tools they already monitor, including task status changes, case activity, asset events, Investigation Hub activity, and system notifications.

Users can manage their personal channel preferences from Account > Notification Settings. Notification types are grouped by category, and users can choose whether each type is delivered in-app, by email, or only when the event is related to them. Email notifications include structured event details and links back to AIR.

Administrators can configure Slack, Microsoft Teams, and Mattermost destinations from Settings. Slack supports both workspace-based channels and incoming webhooks, while Teams and Mattermost use webhook-based delivery. Each destination can be enabled, disabled, tested, and routed to selected notification types.

API Token Expiration Notifications

AIR now notifies API token owners when a token is close to expiration. The notification includes the token name, description, creation date, last-used date, and expiration date without exposing the token value.

This helps administrators and API users rotate credentials before integrations fail, reducing service interruption risk for automated workflows and external tooling.

Asset Management and Filtering

Advanced Expression-Based Filtering for Assets

AIR now supports recursive expression-based filtering for assets, disk images, and case assets. Analysts can combine nested AND/OR groups and field-specific operators to build precise filters across names, types, status fields, dates, tags, metadata, cloud attributes, and other asset properties.

The Advanced Filter experience includes live result counts, CSV import of up to 10,000 values, saved preset support, and consistent behavior across asset lists, exports, statistics, task targeting, and bulk actions. This helps analysts move from investigation hypotheses to targeted action without writing scripts or manually translating filters between product areas.

Explicit selections and exclusions are represented as filter expressions, so select-all workflows and deselected assets retain a clear target definition.

CSV-Based Asset Targeting

Expression filtering supports CSV-imported values for asset identifiers and other supported fields. This is useful when investigation teams receive a list of hostnames, asset names, or other indicators from another tool and need to apply AIR actions to that exact subset.

Analysts can import the values into Advanced Filter, review the matching count, and then use the resulting filtered set for exports, tagging, evidence collection, Hunt/Triage, or other bulk actions.

Asset Tag Catalog

AIR now includes an Asset Tag Catalog under Library. Administrators can create, rename, delete, search, and manage organization-scoped asset tags without first assigning them to an asset.

This supports tag governance and investigation readiness. Teams can predefine tags such as investigation status, containment state, critical server role, or business ownership before responders are deployed or before assets are available in AIR.

The Assets sidebar now supports inline tag creation and rename workflows. Asset tag counts can deep-link back into the Assets view, helping analysts quickly focus on assets assigned to a specific tag.

Auto Asset Tag Rule Tag Creation

When an Auto Asset Tag rule is saved, AIR now creates or updates the related tag in the catalog immediately. The tag no longer remains invisible until the first asset matches the rule.

This makes rule configuration easier to validate. Administrators can confirm that a newly defined tag exists, use it in filters, and maintain a consistent taxonomy even before the rule has matched any assets.

Responder Auto Update Visibility

AIR now persists Responder update lifecycle information for each asset. The Assets list includes version status, and the asset detail page shows update status, update reason, and update history for automatic, manual, and retry attempts.

Administrators can understand why an asset is waiting, scheduled, excluded, failed, retrying, or blocked by maintenance or running work. This reduces uncertainty during fleet updates and gives Support and operations teams a shared view of update state.

Responder Update Policies now include clearer default-policy wording, a count of manually excluded assets, and a searchable modal for reviewing those assets. Administrators can select excluded assets and include them back into update policies directly from the modal.

The excluded-assets view also shows which update policy would apply after inclusion. This helps administrators understand the effect of re-enabling updates before making the change.

Evidence Collection and Repository Integrations

Box Evidence Repository

AIR now supports Box as an evidence repository provider. Administrators can create Box repositories from the Evidence Repositories settings area and configure supported authentication methods, destination folder ID, and optional subfolder paths.

Box repositories can be selected in supported evidence collection workflows where upload behavior is compatible with Box. AIR validates Box connectivity and encrypts stored Box credentials.

Because Box uploads require the total file size up front, AIR clearly disables unsupported streaming scenarios such as direct collection and interACT transfers for Box. The UI includes guidance explaining these limitations so administrators can choose the correct repository type for the collection workflow.

AI Evidence Collection Profile and Collectors

AIR now exposes AI application artifact sources in acquisition profiles for Windows, Linux, and macOS. These sources are available through the acquisition profile evidence selection experience and can be included in custom profiles.

A new predefined AI Evidence Collection profile includes the available AI artifact sources across supported operating systems. This gives analysts a faster path to collect local AI tooling artifacts during investigations where AI application usage may be relevant.

The existing Full and Compromise Assessment predefined profiles continue to include the relevant artifact sources.

Improved Disk Image and Evidence Acquisition Workflows

Quick Start acquisition flows received additional safeguards and consistency improvements. Large asset selections now display typed confirmation before assignment in supported Quick Start workflows, reducing the risk of starting broad tasks unintentionally.

Quick Start Acquire Evidence, Acquire Image, Image Evidence Acquisition, Full Text Search, Triage, Auto Asset Tagging, Update Responder, and Comparison workflows now use more consistent selection, validation, scheduling, case selection, and repository confirmation behavior. This helps analysts follow the same task setup pattern across collection and analysis workflows.

Investigation Hub and Analysis Workflows

Investigation Import Reliability

Investigation Hub import handling is now more resilient when imports are retried, restarted, or reprocessed. AIR now cleans up assignment-specific imported data based on database state rather than relying on retry counters, reducing the risk of duplicated evidence rows after interrupted imports.

Drone findings import cleanup now covers the drone-owned evidence tables and related metadata written by the import, not only the findings table. Parent import retry behavior was also adjusted so active child imports are not wiped by a retry of the parent job.

These changes help preserve investigation data consistency and reduce the chance that repeated imports create inflated row counts or misleading import statuses.

Threat Intelligence and External Integrations

TAXII Feed Duplicate Action and Indicator Labels Filter

TAXII Feeds now include a Duplicate action. Administrators can start a new feed configuration from an existing feed, including the values that can be safely prefilled, and then edit the configuration before saving.

TAXII indicators now support filtering by labels. This helps analysts focus on indicators associated with selected STIX labels and makes it easier to explore intelligence feeds by category or source context.

Outpost is Accessible in AIR

AIR now includes Outpost feature. When enabled, administrators can access the Outpost entry point and related product information from the AIR interface.

This provides a clearer path for customers evaluating or adopting Outpost capabilities alongside AIR investigation and response workflows.

Bug Fixes

• Restricted off-network package downloads to authorized users. AIR now requires assignment privilege and package ownership before serving off-network responder packages through private or public download routes. This prevents organization-scoped users from downloading another organization’s package and accessing repository connection details embedded in that package. Signed share links remain unchanged and still require a valid server-issued signature.
• Hardened organization isolation across public APIs, WebSockets, scheduled tasks, and configuration paths. AIR now applies missing organization ownership checks to task cancellation by filter, public scheduled Hunt/Triage updates, scheduled Auto Asset Tagging updates, public Auto Asset Tag rule deletion, evidence repository validation by ID, Investigation Hub WebSocket connections, and interACT WebSocket connections. These fixes align WebSocket and public API behavior with the guarded REST routes and prevent cross-organization access to live investigation activity, task control, repository validation, and response sessions.
• Blocked privilege escalation through role and organization assignment. AIR now prevents organization-scoped administrators from granting all-organization access unless they already have that scope. Role assignment now verifies that the caller is authorized to grant the privileges contained in the selected role, preventing a low-privilege user manager from assigning a higher-privileged role to themselves or another user.
• Strengthened Investigation Hub SQL query protections. The v2 SQL query endpoint now applies stricter read-only safeguards, function and cast allowlists, scope anchoring, and safer error handling. This prevents queries from escaping the selected investigation scope, reaching restricted database metadata, or using unsafe object-reference and XML helper paths.
• Closed SQL injection paths in asset sorting and Investigation Hub global search. AIR now validates sortable fields and evidence table identifiers before building queries. This prevents crafted sort or evidence category values from influencing database query structure while preserving supported sorting and search behavior.
• Fixed AI Assistant output rendering. Model-generated HTML is now rendered as inert text instead of live DOM content. This prevents script execution from AI-generated responses while preserving markdown and code display behavior for investigation assistance.
• Replaced cleartext temporary passwords with reset links. Admin-initiated password reset now returns a time-limited reset URL instead of a temporary password. The user’s current credential is invalidated, the reset token is single-use, and the UI shows a copyable reset link with expiry information.
• Improved cookie security attributes. AIR now sets secure cookie attributes for applicable UI and analytics cookies when served over HTTPS, while preserving compatibility for HTTP-based installations.
• Made license capacity enforcement atomic during Responder registration. AIR now serializes slot-consuming registration paths so concurrent registration waves cannot exceed the licensed asset capacity. Existing managed asset re-registrations use a fast path and do not consume additional license slots.
• Reduced notification query load on large notification tables. Notification count behavior was improved so large notification backlogs do not cause repeated heavy database work for the header badge and notification list. This improves Console reliability during high-volume asset registration or operational event bursts.
• Fixed SSL restoration after backup restore. On-premises deployments now re-run SSL bootstrap on every application boot and retry if startup dependencies are not ready. This allows restored SSL settings to re-materialize the web configuration files and prevents the web container from staying unhealthy after single-tier to two-tier migration restores.
• Fixed disk image and cloud asset detail ID confusion. Detail views now validate that route parameters are real asset IDs before calling asset-scoped APIs. This prevents misleading “Asset not found” errors and unnecessary 404 responses when navigation paths carry task IDs or other identifiers.
• Fixed case task import retry from the Import Status column. Case task tabs now retry failed imports against the case investigation rather than an assignment-level or missing investigation ID. The retry action now sends the correct request and no longer shows a forbidden error for authorized users.
• Fixed Investigation Hub evidence reload banner placement. The “New evidence has been added to the investigation” banner now remains at the top of the page and no longer appears in the center of the screen or blocks import controls.
• Improved Investigation Hub import idempotency. Re-importing or retrying the same task assignment no longer duplicates imported evidence rows. Drone findings cleanup now includes related drone-owned evidence tables and metadata, and parent retry behavior no longer wipes active child import work.
• Restored task execution log ingestion in the refactored Investigation Hub ingestion pipeline. Task execution logs are now populated through the refactored ingestion path, so the Task Execution Logs tree appears when the collected data contains task logs.
• Fixed Responder update actions for manually excluded assets. AIR no longer offers manual Responder update actions for assets excluded from updates. Bulk update actions and asset detail update cards now use the same eligibility rules as the backend assignment filter, preventing zero-assignment tasks and misleading success messages.
• Restored large-task confirmation for select-all assignment flows. Select-all actions that target large asset sets now display the confirmation dialog based on assignable count, even when the assignable count is a small percentage of the full organization asset count.
• Fixed RelayPro manual deployment package naming. The RelayPro Linux deployment instructions and downloaded package naming now align so the provided installation command works without manual filename edits.
• Fixed Acquisition Profile dropdown mouse-wheel scrolling. The acquisition profile dropdown now supports mouse-wheel scrolling inside slide panels, improving profile selection when many profiles are available.
• Improved Google Cloud Storage validation messages. Billing-disabled and permission-related validation failures now return clearer messages instead of misleading users with an “Invalid Project ID” error when the project ID is correct.
• Sanitized evidence repository validation errors. AIR no longer returns raw backend error details, internal paths, request configuration, or low-level network codes in evidence repository validation responses. Azure and S3-compatible validation failures now return safer user-facing messages while preserving detailed diagnostics in server logs.
• Fixed long-expired license UI gating. The UI now remains locked when a license is expired even after the remaining-days value becomes negative. This keeps the Console state aligned with backend license decisions.
• Improved GCP account and repository behavior. Heavy Google Cloud clients now load only when a GCP workflow is actually used, reducing memory usage for tenants without GCP activity. GCP validation errors are also mapped more accurately.
• Fixed GCP account creation metadata failure paths. GCP account creation and validation flows were updated so plugin metadata retrieval and related SDK usage behave reliably during account setup.
• Fixed backup, disk usage, evidence repository, user management, deploy, and off-network UI reliability issues found during integration coverage work. These areas received improved route guarding, loading and error handling, state reset behavior, and consistent navigation while keeping existing customer-facing URLs unchanged.
• Fixed Quick Start Update Responder conflict preflight ordering. Immediate Responder update tasks now always run validation, broad-task confirmation, conflict preflight, and assignment in the correct order, preventing conflict checks from being skipped after large-selection confirmation.
• Fixed Quick Start Image Evidence Acquisition large-selection confirmation. The disk image evidence acquisition wizard now shows the large-selection confirmation dialog before broad assignments, matching other Quick Start task flows.
• Fixed task import status display and retry state in case task tabs. Failed import rows now read the correct import status field and show Retry when appropriate, including assignments that have not yet populated investigation metadata.
• Fixed UI messaging and rendering around Box repository limitations. Box setup and disabled-state notices now use clearer copy and better multi-line alert layout, helping administrators understand upload-only behavior and folder selection risks.
• Fixed Auto Asset Tagging and Responder Update Policy UI consistency issues. Auto Asset Tag and Responder Update Policy views now better reflect selected assets, excluded assets, policy matches, and available actions.
• Fixed Investigation Report oversized logo validation. Oversized company logos are now rejected consistently during validation instead of sometimes falling through to an internal error.
• Improved service and container hardening. Runtime container images and bundled services were updated or adjusted to remove outdated operating system components and resolve reported security findings without changing product workflows.

What’s New?

• Cyber Threat Intelligence (STIX/TAXII Feed) Integration for operationalized threat intelligence: AIR can now connect to TAXII 2.x threat intelligence sources, pull STIX indicators, parse supported indicator types, and convert them into YARA, Sigma, and osquery Hunt/Triage rules. This helps analysts bring external threat intelligence directly into investigations without manually exporting, converting, and uploading indicators.
• Responder update policies: Administrators can manage automatic Responder updates through policy groups and filters, including policy scheduling, asset match counts, and per-asset update status visibility. This helps teams keep Responders current while controlling update rollout for sensitive or operationally constrained assets.
• Disk I/O Priority for tasks and policies: AIR now supports a Disk I/O Priority resource limit for policy and task configurations. Analysts can tune collection and response activity to reduce performance impact on critical assets during active investigations.
• Safer Active Directory disable flow: Disabling Active Directory integration now includes clearer impact information and an explicit keep-or-remove decision for AD-synced assets. This reduces the risk of unintended Responder uninstall activity and gives administrators better control during directory integration changes.
• Expanded Windows SMB event coverage in acquisition profiles: Full, Quick, and Compromise Assessment profiles now include additional SMB-related Windows event records. This gives investigation teams stronger visibility into file-sharing, authentication, and SMB-related activity during evidence collection.
• PostgreSQL 18 support for on-prem deployments: AIR now supports PostgreSQL 18 for on-prem environments with version 5.23. After upgrading AIR, administrators can schedule the PostgreSQL upgrade separately during a planned maintenance window, helping ensure continued compatibility, performance, scalability, and support for future AIR releases.
• Dual Go runtime support for Windows Responders: AIR now automatically delivers a Go 1.26-based Responder to Windows 10 and later devices, while earlier Windows versions continue to receive the Go 1.20 build. Both variants provide the same functionality, improving security scanner compliance without affecting legacy OS support or requiring configuration changes.

New Features & Improvements

Threat Intelligence and Hunt/Triage

Cyber Threat Intelligence (STIX/TAXII Feed) Integration

AIR now supports TAXII Feed Integration for connecting to TAXII 2.x compliant threat intelligence servers. Teams can configure a feed with a server URL, authentication method, collections, sync interval, and conversion preferences. AIR then pulls STIX indicators and converts supported indicators into investigation-ready Hunt/Triage content.

The feature supports public and authenticated feeds, collection discovery, manual and scheduled sync, sync logs, indicator browsing, confidence thresholds, and managed or snapshot ownership modes. Managed feeds regenerate system-owned rules as indicators change, while snapshot feeds allow analysts to capture a point-in-time set of indicators without modifying or deleting previously generated rules.

For analysts, this reduces the time between receiving intelligence and using it in an investigation. File hashes, domains, URLs, registry keys, mutexes, process names, direct YARA, and direct Sigma indicators can be transformed into YARA, Sigma, and osquery rules according to the selected conversion configuration.

To use the feature, open the Integrations area, create a TAXII feed, test the connection, select collections, choose the rule generation settings, and save the feed. After sync, generated Hunt/Triage rules become available for investigation workflows according to the configured ownership mode and rule settings.

Expanded SMB Event Log Coverage

Windows acquisition profiles now include expanded SMB event coverage. Full, Quick, and Compromise Assessment profiles have been updated with SMB client, SMB server, and Security channel event selections that preserve higher-value SMB investigation signals while limiting noise in faster profiles.

This improvement helps analysts review file-sharing, share modification, authentication, and SMB security activity during post-incident investigations. It is especially useful when investigating lateral movement, remote access to shared resources, and suspicious file access patterns.

The Full profile includes the broadest researched event coverage, Quick includes a security-focused subset, and Compromise Assessment includes the strongest low-noise indicators. Existing event selections remain unchanged.

Investigation Hub and Case Workflows

Case Task Import Status Visibility

Case task listings now reflect Investigation Hub import status more accurately. When task data is imported into Investigation Hub, AIR mirrors the status into the task assignment metadata used by case task grids.

This gives analysts clearer visibility into whether task results have been imported and are available for review in Investigation Hub, reducing confusion when evidence appears in Investigation Hub but the case task list previously showed the import status as not applicable.

Assets, Responders, and Task Execution

Responder Update Policies

AIR now provides grouped Responder update policies in Settings. Administrators can configure automatic update behavior through policy cards, filters, schedules, matching asset counts, and a unified save workflow.

The asset detail view now shows resolved Responder update status, helping operators understand whether an asset receives automatic updates, which policy applies, and what action may be needed. This improves update governance across large environments where different asset groups require different rollout behavior.

A typical use case is to define a policy for a tagged or filtered group of production servers, apply a specific update window, and review matched assets before saving. New assets that match the policy criteria can then inherit the intended update behavior without a manual bulk operation.

Disk I/O Priority for Task Resource Control

Task and policy configuration now includes Disk I/O Priority. The priority can be set from Lowest to Highest, with Medium as the default. AIR passes the selected priority to the Responder for supported task types.

This gives analysts and administrators more control over the runtime impact of investigation tasks. During active response, teams can lower priority for business-critical systems or increase priority when rapid evidence collection is more important than background resource usage.

The setting is available in task advanced options, policy resource limits, and interACT shell task options. Existing configurations that do not include the field continue to rely on Responder defaults.

Dual Go Runtime Support for Windows Responders

To improve security scanner compliance while maintaining compatibility with older Windows operating systems, AIR now delivers Windows Responders with the appropriate Go runtime based on the target OS version.

Starting with Responder 3.0.0, Windows 10 and later devices receive a Responder built with Go 1.26, while earlier Windows versions continue to receive a Go 1.20 build. Both variants provide the same Responder package, functionality, and feature set—the only difference is the embedded Go runtime.

This enhancement addresses vulnerability scanner findings related to older Go runtime versions (such as VOC-2709) without requiring customers to choose between modern security compliance and legacy operating system support.

Responder selection is performed automatically by AIR:

Windows 10 and later: Latest Responder (Go 1.26)
Earlier than Windows 10: Legacy Responder (Go 1.20)

No additional configuration or deployment changes are required. Both Latest and Legacy Responders continue to be fully supported.

As part of this change, the Windows MSI installer size increases from approximately 58 MB to 106 MB due to the inclusion of the newer Go runtime. Linux and macOS support for dual runtime delivery will be introduced in a future release.

Administration and Platform Operations

PostgreSQL 18 Support is Now Available for On-prem Deployments

After upgrading AIR to v5.23, administrators can upgrade PostgreSQL separately at a time that fits their maintenance schedule by following the PostgreSQL Upgrade Guide. The database upgrade is not performed automatically and requires planned downtime, during which AIR will be temporarily unavailable.

PostgreSQL 18 will become AIR’s supported database configuration at the end of August, so on-prem customers are strongly encouraged to plan their upgrade accordingly.

Before you begin, we recommend that you:

• Wait at least 24 hours after upgrading AIR.
• Close inactive cases.
• Create an AIR Backup.
• Review the PostgreSQL Upgrade Guide.

Safer Active Directory Disable Flow

Disabling Active Directory integration now provides a safer and more explicit flow. AIR shows an impact summary, including total affected assets and how many have Responders installed, before the operator chooses whether to keep or remove AD-synced assets.

This reduces the operational risk of disabling directory synchronization. Administrators can stop synchronization without unintentionally removing managed assets or uninstalling Responders, and can make a deliberate choice when cleanup is required.

Setup Wizard Proxy and Trusted CA Validation

The setup wizard now supports proxy validation before installation. Proxy and trusted CA checks use the same connectivity validation approach as the post-install Settings experience, helping administrators verify outbound connectivity earlier in the deployment process.

This improvement helps reduce setup friction in restricted environments. Administrators can validate proxy settings during installation and correct connectivity issues before completing the AIR deployment.

Backup History Encryption Column

The Backup History table now includes an Encryption column. The column shows whether each backup was encrypted, using the existing backup data already displayed in Backup Details.

Security, Governance, and Authorization Improvements

Git Repository Organization Scope Enforcement

Git Repository API endpoints now enforce organization scope more consistently. Users and API tokens with Git Repository privileges can only access repositories associated with organizations they are authorized to use.

This strengthens governance for customers using Git repositories to import or synchronize investigation content. Filtering, retrieving, creating, updating, deleting, syncing, and viewing logs now apply stricter organization relevance checks.

Privilege Dependency Validation

AIR now validates privilege dependency definitions more strictly. Every catalog privilege must have an explicit dependency entry, even when it has no dependencies.

This helps administrators configure roles more consistently. When a privilege requires a related view or supporting privilege, role configuration can auto-select or validate the required dependency instead of leaving users with incomplete access that causes screens or actions to fail.

Bug Fixes

• Expired task assignments now finalize parent task status. When assignments expired after remaining in Assigned or Processing for an extended period, parent tasks could stay stuck in Assigned or Processing even though no active assignments remained. AIR now treats expired assignments as settled for task completion accounting, recalculates the parent task, and includes a self-heal sweep for historical stuck tasks. This helps administrators and SOC teams identify whether investigation work is actually active.
• Retry Upload now preserves custom evidence repository folder naming. Retried uploads no longer land at the root of the evidence repository when custom evidence collection naming is configured. AIR now uses the original acquisition context so retried evidence follows the expected folder hierarchy.
• Evidence repository validation delay reduced in acquisition workflows. Selecting an unreachable repository in the acquisition customization step now times out faster and shows the existing inaccessible-repository warning instead of pausing for about 10 seconds or advancing without feedback.
• Global Search and Grid Search consistency improved. Grid search behavior has been corrected so users are less likely to miss records that are returned by Global Search for the same keyword.
• Case task import status now reflects imported Investigation Hub data. Case task pages no longer show imported task data as not applicable when the data is available in Investigation Hub.
• Asset resource usage no longer shows misleading zero-based values while metrics are pending. Newly registered assets now show a pending usage state until CPU, memory, and disk metrics arrive, instead of displaying values such as 100% CPU free or 0 B memory free.
• Production UI blank page after build upgrade fixed. A loading issue that could cause the AIR Console UI to display a blank page in production and staging builds has been resolved.
• All export functions now work behind proxied environments. Export preflight handling now uses a standard success response instead of a non-standard status code that could be rewritten by edge infrastructure. The UI now starts downloads on standard successful preflight responses and shows an error when export preflight fails.
• GCP account creation and verification now work with proxy and trusted CA configurations. AIR corrected the GCP client transport behavior that could fail with plugin metadata or response parsing errors during account creation.
• Azure remote command errors now show the real service message. Azure VM command failures no longer surface JSON parsing errors when the cloud service returns a plain-text error. Operators now see the actionable Azure error message, such as when a VM must be running before a command can execute.
• Full Text Search task flow now validates mandatory case selection consistently. AIR now shows the required case warning when progressing through the Full Text Search task flow without selecting a case, matching the Start action behavior.
• Responder update default schedule drawer now respects disabled time frames. The Default policy schedule drawer no longer shows “Set Time Frame” enabled when the backend explicitly has the time frame disabled.
• Forward proxy handling for internal processor traffic corrected. When a forward proxy is enabled, trusted Console-to-processor traffic for internal infrastructure now bypasses the proxy for private network targets. This prevents processors from appearing offline and disk image actions from being disabled when the proxy cannot resolve internal processor hostnames.
• Push-type task assignments now fail correctly when processor delivery fails. Disk image and DRONE-related assignments no longer remain in Assigned indefinitely after all processor assignment retries fail. AIR now marks affected assignments as Failed and rolls up the parent task status.
• Processor-side cleanup during asset deletion now reaches trusted internal processors. Asset deletion cleanup calls now use the trusted private-network path, preventing orphaned processor-side files when internal processor hosts were blocked by outbound safeguards.
• PST evidence import no longer blocks the main application event loop. PST import now runs asynchronously with streaming and bounded processing. This prevents long event-loop stalls, Redis connection storms, and health check failures in shared SaaS environments while still surfacing import failures to the UI.
• Worker processes now initialize white-labeling configuration. Task delivery failures caused by missing white-labeling configuration in worker processes have been resolved.
• Asset and case association lists now handle empty scopes correctly. Asset or Responder case tabs no longer show all organization cases when the asset has no related case assignments. AIR now returns an empty list when the related case scope is explicitly empty.
• interACT command-result downloads now require read permission. AIR now enforces the appropriate interACT read privilege before users can download persisted command output files. Enumerate-only users can no longer reach command-output resolution paths.
• Git Repository organization access tightened. Git Repository operations now reject access to repositories or organization scopes outside the caller’s assigned organizations.
• Gaps in case, task, and assignment counts were reduced for large environments. Task visibility queries and count retrieval were optimized to reduce expensive repeated list and count calls, especially for scheduled task views in large tenants.

What’s New?

• Retry failed task assignments without recreating tasks. Analysts can now retry eligible failed task assignments from task and asset workflows. This helps investigation teams re-run failed collection or analysis work on affected assets without rebuilding the original task, preserving operational context and reducing response time.

• Responder update workflows are easier to manage at scale. Responder update tasks can now be named and opened directly from tag action menus. This improves staged rollout tracking across large asset groups and helps administrators target updates more confidently.

• Advanced auto asset tagging conditions are available. Auto asset tagging rules now support additional negative and pattern-based operators such as “does not contain,” “does not start with,” and regex-style matching. This helps security teams classify assets more accurately in complex environments.

• Linux file system enumeration can be configured to include or exclude network-mounted file systems. Acquisition workflows now include an optional setting to include or exclude mounted network file systems when collecting Linux file system enumeration data. This gives analysts broader visibility when relevant artifacts may exist on mounted storage while keeping the default behavior conservative.

New Features & Improvements

Investigation Hub

Clearer Search Results and Failure Visibility

Investigation Hub now distinguishes between a successful search that returns no results and a search that could not complete because of a backend error, timeout, connection issue, or permission problem. Evidence grids now display an error row when data loading fails instead of showing an empty “No Records Found” state.

Global search also tracks success, partial success, and failure states. If some evidence categories fail while others succeed, analysts can still review partial results and see that the search did not fully complete.

Improved Large Evidence Detail Rendering

Evidence detail panels now handle very large array fields more efficiently. AIR deduplicates repeated values, shows occurrence counts, and paginates large lists instead of rendering every item at once.

This improves responsiveness when reviewing evidence items with thousands of values, such as matched strings or large parsed fields. Analysts can still copy, filter, and open values in relevant tools while avoiding browser freezes during evidence review.

Evidence Detail Label Localization

Network-related fields in the Investigation Hub’s Evidence Details view now display properly formatted labels — such as “IPv6 Address,” “IP Address,” “DHCP Enabled,” and “DHCP Server” — instead of auto-generated casing. The system resolves labels through translations first and falls back to generated labels only when no translation exists, improving readability for analysts reviewing network adapter data during investigations.

This improves readability in evidence detail views and helps analysts interpret network adapter data more quickly during asset and network-focused investigations.

Asset and Responder Operations

Retry Failed Task Assignments

AIR now supports retrying eligible failed task assignments without creating a new task. Users can retry a single failed assignment, retry all failed assignments from a task detail view, or retry eligible failures from bulk selections.

Retry applies only to failed assignments that are safe to re-run. AIR filters out ineligible items and provides confirmation before the retry starts. After a retry is triggered, the assignment returns to active processing and follows the normal task lifecycle.

This improves response efficiency when collection or analysis fails because of a temporary condition. Analysts can recover failed work while keeping the original task context and history.

Custom Names for Responder Update Tasks

Responder update tasks can now use a custom task name. If the user leaves the task name empty, AIR continues to generate a default name automatically.

This is useful for staged rollout plans where administrators update different asset groups over time. Meaningful task names make it easier to distinguish rollout phases, review progress, and communicate update status to operations teams.

Update Responder from Asset Tags

The tag action menu now includes an Update Responder option. When selected, AIR opens the responder update workflow pre-filtered to assets with the selected tag.

This supports customers who use tags to manage responder update waves. Administrators can target tagged asset groups directly without manually rebuilding filters in the Assets view.

CPU Core Limit Controls in Task and Policy UI

CPU Core Limit settings are now visible in policy limitations, task advanced options, and interACT shell task resource limits where supported by the Responder. The setting works alongside existing CPU percentage controls.

This gives administrators more control over how resource-intensive tasks behave on critical assets.

Evidence Collection and Acquisition

Optional Linux Network-Mounted File System Enumeration

Acquisition workflows now include an optional File System Enumeration Configuration setting for Linux. When enabled, AIR includes mounted network file systems such as network shares during Linux file system enumeration.

The setting appears when the selected acquisition profile includes Linux file system enumeration. It remains disabled by default to avoid unexpected collection from mounted network locations.

This gives analysts control when relevant artifacts may reside on mounted storage, while preserving predictable default acquisition behavior for standard investigations.

Improved Disk Image Parse Evidence Flow

The disk image File Explorer “Parse evidence” flow now preserves selected paths and related context when opening Quick Start. AIR also adjusts date and size defaults for path-scoped runs so explicitly selected files are not excluded by broad profile defaults.

This improves analyst workflows when parsing evidence from selected disk image paths. The selected files remain in scope, reducing manual reconfiguration and avoiding missed artifacts due to inherited filters.

Backup Encryption Status in Backup Details

The Backup Details view now shows whether encryption was enabled when each backup was created. New backups store this value at the time the backup is queued.

Existing backup records created before this release show the status as Unknown. This gives administrators better visibility into backup posture without requiring additional support checks.

Hunt/Triage and Rule Management

Improved Rule Validation Reuse

Hunt/Triage, acquisition, and interACT command validation now share common validation behavior for osquery syntax and schema checks. This improves consistency when users validate rule content or run query-based investigation actions.

For analysts, this means unsupported or invalid query content is more likely to fail early with clearer feedback instead of failing later during task execution.

Optimized Git Repository Rule Sync

Git repository synchronization now fetches repository archives for supported providers and reads file content locally during a sync. This significantly reduces the number of provider API calls required for large rule repositories.

For teams managing large Hunt/Triage rule repositories, initial syncs are less likely to hit provider rate limits and produce fewer skipped-file messages. If archive retrieval fails, AIR falls back to the existing per-file behavior.

Auto Asset Tagging

Additional Rule Operators

Auto asset tagging rules now support additional operators, including negative conditions and regex-style matching for supported fields. Examples include hostname does not contain, hostname is not, hostname does not start with, and related negative match patterns.

This helps administrators build more precise asset classification rules. For example, a rule can include assets whose hostname starts with a regional prefix while excluding assets whose hostname contains a specific platform or workload marker.

Predefined Auto Asset Tagging Rules Are Restored and Protected

AIR now verifies predefined auto asset tagging rules during startup and restores any missing predefined rules. The system also protects predefined rules from edit and delete actions while still allowing administrators to enable or disable them.

This keeps out-of-the-box tagging behavior consistent across environments and reduces the risk of losing predefined rules during maintenance or cleanup. Custom customer-created rules remain unaffected.

interACT

More Reliable interACT Session Handling

interACT run, cancel, and close operations now include asset readiness checks and improved handling for stale or warming sessions. AIR can retry during a readiness window and return clearer errors when a session is not ready.

This improves live-response reliability and helps analysts understand whether a command failed because of validation, asset readiness, or session availability.

Enterprise Connectivity and Administration

Proxy Exclusion List

Proxy settings now support an exclusion list. Administrators can define destinations that should bypass the configured proxy and be reached directly.

The exclusion list supports hostnames, wildcard domains, IP addresses, and CIDR ranges. This helps organizations where internet-bound traffic must use a proxy, but internal services such as evidence repositories must be reached directly.

The exclusion list is available in the Proxy settings UI and is applied to outbound Console connections that use the managed transport configuration.

Enhanced Proxy Testing and Troubleshooting

AIR now includes a proxy connection test with structured diagnostics. Administrators can test connectivity to a target URL without saving settings and review clearer status, duration, and categorized error information.

This improves troubleshooting in environments with strict network controls, SSL inspection, proxy authentication, or internal certificate authorities. The setup wizard also supports proxy testing before installation is completed.

Trusted CA Save Without Validation

Trusted CA certificate import now supports saving a certificate without requiring live validation. This helps proxy-only or isolated deployments where the certificate is valid but the validation target is not directly reachable.

AIR also provides clearer validation feedback and better handling for proxy CA removal, reducing the need for manual configuration changes during troubleshooting.

Bug Fixes

• Responder update task scope now respects the selected Issue filter. In a customer-reported production case, using “Select all records” with an Issue filter during a Responder update could widen the task to all updatable assets in the organization while the confirmation dialog showed the filtered count. AIR now intersects the user’s Issue filter with valid update-related issues and rejects filters that contain no updatable issue. This prevents unintended large-scale Responder update rollouts.

• Bulk action confirmation counts now preserve “No” filters. A customer-reported issue caused stats requests to drop boolean false filters such as Is Server = No, inflating confirmation counts for bulk actions. AIR now serializes false-valued filters correctly so confirmation dialogs and bulk action counts match the filtered asset set.

• Update Responder Version now closes the asset action menu. When opened from an asset detail action menu, the update panel no longer leaves the dropdown visible over the page.

• Asset update exclusion match counts now include only responder-managed asset types where applicable. Auto Responder Update Exclusion previews no longer count disk images, cloud assets, or other non-responder asset types when evaluating responder update exclusion rules.

• IP Restriction no longer marks the application container unhealthy. The internal loopback health check for application information is now exempted from IP Restriction only when it originates from loopback. External restricted clients remain blocked.

• OIDC SSO attribute mapping now persists correctly in the settings view. OIDC claim mappings are returned with the provider configuration after refresh, so administrators can confirm and maintain custom attribute mappings from AIR.

• OIDC SSO role claims now support single-string values. AIR now treats a single role claim string as a one-item role list, improving compatibility with identity providers that emit one role as a string instead of an array.

• Investigation Hub flags filtering now preserves organization scope. A crafted filter could bypass the intended organization boundary when querying custom flags. AIR now groups client filters so organization scoping remains mandatory.

• Triage tag deletion now enforces organization authorization. AIR now checks the owning organization before allowing triage tag deletion across private, public, and legacy routes.

• interACT command-snippet tag deletion now enforces organization authorization. AIR now resolves the tag’s organization before update or delete operations, preventing cross-organization changes when a foreign tag ID is known.

• User update authorization now protects higher-tier administrators. A lower-tier administrator can no longer downgrade a Global Admin or Organization Admin through user update routes and then delete the account.

• User group mutation responses no longer expose sensitive member fields. Create and update responses now return sanitized user group data, matching the safe read-path projection.

• Portable disk image package handling is hardened. Portable disk image packages no longer include repository credentials or license data, remote asset package creation is rejected, and downloads enforce privilege and organization ownership checks.

• Off-network share links now require a signature. Anonymous off-network package share links now include and verify a signed parameter before serving a file. Authenticated download behavior is unchanged.

• Package download audit events are now scoped to the owning organization. Portable and off-network package download events no longer appear as system-wide audit entries visible to unrelated organization administrators.

• Organization deletion audit visibility is restored. Organization deletion events are now scoped so the audit entry remains visible after the organization is deleted, while still recording the deleted organization’s name and identifier.

• Chained audit and syslog entries can be suppressed. AIR adds separate settings to suppress chained log entries created by indirectly affected entities, reducing noise during high-volume cleanup operations such as large asset deletions.

• Investigation report PDF generation no longer loads remote subresources. Report rendering now allows only local file and embedded data resources during PDF generation, preventing unexpected outbound requests from report content.

• Investigation report logos now reject remote URLs and unsupported values. The company logo field now accepts only supported embedded image data within size limits. Existing URL-based logo values must be replaced by uploaded images.

• Outbound redirect validation now blocks disallowed IP literal redirects. AIR validates each redirect hop for outbound HTTP requests so redirects cannot bypass network destination controls.

• Two-factor verification now includes bounded retry and replay protection. AIR now rate-limits failed two-factor and recovery attempts and prevents reuse of an already accepted time-based code within its validity window.

• Authentication endpoints now include per-source rate limiting. Login and forgot-password flows now include an additional per-source limit to reduce targeted account lockout noise while preserving existing per-account protections.

• Password policy has been strengthened. New local and API password paths now reject common weak passwords and support longer passphrases. Existing login behavior is unchanged so current users are not locked out by the policy change.

• Public JavaScript bundles no longer include all Userflow environment tokens together. Build-time environment configuration now includes only the token required for the running environment, reducing unnecessary exposure of unrelated environment identifiers.

• Organization and user group names now reject unsafe markup. AIR enforces consistent safe-name validation and prevents raw HTML-like markup from being stored in these administrative fields.

• Client-side CSV exports now defang formula-leading values. User list, imported user, evidence, task, file explorer, and report-related CSV exports now route through a shared safe export helper.

• Investigation Hub evidence pages with high finding fan-out no longer fail with server errors. AIR now deduplicates lookup keys before building comment queries, preventing excessive query bindings on evidence categories with many related findings.

• Investigation Hub Flag “Is blank” and high-volume evidence views are more stable. Query and rendering improvements reduce failures and improve feedback when large findings or evidence sets are involved.

• Task execution logs are visible after ingestion in environments using the refactored pipeline. The refactored ingestion path now populates the same task execution log data used by the Investigation Hub navigation tree.

• Temporary directory cleanup no longer follows symlinks outside the temp directory. The cleanup job now treats symlinks as links and verifies deletion paths remain inside the intended temporary directory.

• Trusted CA and proxy validation errors are clearer. Proxy-only and custom CA environments now receive improved validation handling, better error categories, and a save-without-validation option where live validation is not possible.

• S3-compatible evidence repository validation works more consistently with internal certificates and proxy settings. Outbound clients now honor configured proxy and trusted CA settings more broadly, improving validation and repository-related workflows in enterprise networks.

• RPM responder deployment commands now include the option required for unsigned packages. Generated RPM installation guidance avoids manual intervention when package signature checks would otherwise block installation.

• MITRE ATT&CK auto-update save confirmation is restored. Enabling auto-update now shows the expected confirmation and prevents form submission paths from bypassing the warning.

• Backup Details now displays encryption status correctly for new backups. Backup records now capture whether encryption was enabled when the backup was created.

• Disk image acquisition profile creation provides clearer validation and selection behavior. Inline profile creation now shows field errors correctly, keeps the drawer behavior consistent, and automatically selects a newly created profile.

• SDK acquisition task typing has been aligned with the documented response shape. The generated SDK package build no longer fails because of a mismatched assigned-task response type.

What’s New?

• Automatic Responder update exclusion rules help protect critical assets during maintenance windows. Administrators can now define named, policy-style rules that automatically exclude matching assets from automatic Responder updates. This is especially valuable for production systems such as messaging clusters, infrastructure services, and other sensitive assets where an unscheduled Responder restart could disrupt investigation readiness or business operations.

• Expanded macOS artifact coverage improves visibility into user activity. AIR now expands KnowledgeC collection coverage with additional macOS activity streams, including application focus, web usage, lock and power state indicators, audio output, media activity, and modern macOS activity streams. This gives analysts broader context when reconstructing user activity during security investigations.

• Task memory-limit configuration is available across acquisition, Hunt/Triage, and Full Text Search workflows. Memory-limit settings are now available in task advanced options and policy configuration. This helps administrators control task impact on production assets while preserving the ability to collect and analyze evidence at scale.

• Linux file system enumeration now includes mounted local filesystems. File System Enumeration on Linux assets now covers eligible local mounted disks and volumes, not only the root filesystem. Virtual, pseudo, volatile, container, and network filesystems remain excluded by default to avoid unstable runtime trees and performance issues.

New Features & Improvements

AIR Console — Asset and Responder Administration

Automatic Responder Update Exclusion Rules

AIR now supports automatic Responder update exclusion based on saved asset filter rules. Administrators can define one or more named rules under asset update settings, and any asset that matches an enabled rule is automatically excluded from automatic Responder updates.

This improvement is designed for environments where critical systems must be updated only during approved maintenance windows. For example, an administrator can create a rule that matches assets tagged as production infrastructure or sensitive Linux servers. Newly registered assets or assets that receive matching tags later are handled automatically, without requiring manual bulk updates.

The rule-based exclusion is additive with the existing per-asset manual exclusion flag. Manual Responder update actions remain available, so administrators can still update excluded assets deliberately when they are ready.

The asset detail page now also shows which update exclusion rules match the selected asset. This gives administrators a clear explanation of why an asset is being skipped by the automatic update workflow.

Safer Bulk Uninstall and Purge Operations

Bulk uninstall, purge, and uninstall-with-purge operations now support an optional maximum matched-asset assertion. If the filter matches more assets than the configured threshold, AIR stops the operation before making changes.

This is useful for cleanup scripts and scheduled administration workflows where filters may evolve over time. Administrators can use the assertion as a guardrail to prevent accidental removal of more assets than intended.

When no assets match the filter, AIR now returns a clearer not-found response instead of silently proceeding. This helps administrators identify filter mistakes before they rely on automation.

Policy-Based Memory Limit Configuration for Tasks

Memory limit configuration is now available in task advanced options and policy configuration. AIR also passes resource-limit fields through Hunt/Triage and Full Text Search task flows so the configured limits are preserved when tasks are submitted.

This improvement helps administrators control resource consumption on production assets. For investigation teams, it supports safer evidence collection and analysis by reducing the chance that long-running or high-volume tasks consume more memory than expected.

Administrators can configure these limits as part of task or policy settings, depending on the workflow. Existing task behavior remains unchanged when no limit is configured.

Improved First Responder Deployment Experience

The empty asset page now updates the “Deploy your first Responder” action correctly when license capabilities or permissions are available. This improves the onboarding experience for newly deployed AIR tenants and reduces confusion for administrators who have the required access but previously saw the action disabled.

Updated AIR For Chrome Extension Store Link

The Deploy > Chrome package page now points to the updated official Chrome Web Store listing for the AIR For Chrome extension. Quick Deployment actions such as Copy Link to Chrome Store and Add to Chrome now open the updated extension URL.

This ensures administrators and analysts are directed to the current official AIR For Chrome extension when deploying the standalone collector.

Settings and Administration

Additional Month-First Date Formats

User date and time preferences now include additional month-first date format options. These formats better support users in regions where month-first dates are the standard.

Users can select these formats from Profile > Date & Time Preferences. This improves readability in investigation timelines, reports, and operational views for teams that use month-first date conventions.

Improved License Validation Feedback

License validation now preserves the license server’s response more accurately when the license key is invalid or not found. AIR now distinguishes invalid-license scenarios from license server connectivity issues more clearly.

This reduces troubleshooting time for administrators and support teams by pointing them toward the correct root cause, such as an invalid key or capacity condition, instead of suggesting a network issue.

Improved Console Address Certificate Import Flow

The Console Address certificate import flow now handles custom PFX imports more reliably when the Console Address itself is unchanged. The import modal also prevents the PFX password from appearing in the browser URL.

This improves both usability and credential handling for administrators configuring Console Address certificates under Settings > General > Connection > Console Address.

Responder and Evidence Collection

Expanded macOS KnowledgeC Artifact Coverage

AIR expands macOS KnowledgeC parsing with additional high-value activity streams. New parsed streams include application focus, web usage, device lock state, power connection state, battery percentage, audio output route, media now-playing activity, application media usage, and application intents where present on the asset.

These artifacts help analysts build a more complete timeline of user activity and system state during an investigation. For example, application focus and media usage can help confirm whether a user was active, which applications were in use, and how activity correlates with other evidence.

Raw KnowledgeC data collection remains available, while the expanded parsed coverage makes more of the data directly searchable and usable inside AIR workflows.

Linux Shell History Collection for Domain and NSS Users

Linux shell history collection now accounts for user home directories that exist under /home even when the user is not listed in the local password file. This improves coverage for environments that resolve users through directory services or similar identity integrations.

For investigation teams, this reduces the chance of missing command history from domain or externally managed users whose home directories are present on disk. The collector keeps discovery bounded by scanning immediate home directories rather than recursively walking the entire filesystem.

Linux File System Enumeration Now Includes Mounted Local Filesystems

Linux File System Enumeration now enumerates the root filesystem plus eligible local mounted filesystems. Previously, mount points such as /mnt, /media, /srv, and /afs could appear as single directory entries while their mounted contents were absent from FileSystemEnumeration.csv.

AIR applies a Linux-specific traversal policy for eligible local mounts while continuing to exclude virtual, pseudo, volatile, container, and network filesystems by default. Darwin and AIX root-device behavior is unchanged.

For investigation teams, this improves filesystem visibility on Linux assets where evidence is spread across multiple mounted disks or volumes, without expanding collection into unstable runtime or network-backed trees.

Responder Upgrade Safety on Linux Hosts

Linux Responders no longer flush the full connection tracking table on every service start. The cleanup now runs only when isolation artifacts are present and cleanup is actually required.

This change prevents brief network disruptions on NAT-dependent production workloads during Responder updates. It is especially relevant for customers running clustered infrastructure where even a sub-second connection reset can cause service impact.

DRONE Event Classification Improvement

DRONE now classifies Windows Event ID 104 as “Event Log Cleared” only when the provider matches the Windows event log provider. This prevents unrelated USB or smart card driver events from being reported as event log clearing activity.

This reduces false positives and helps analysts focus on activity that is more likely to be relevant during an investigation.

Bug Fixes

• Audit log event filtering now behaves more consistently across Console processes. Customer-reported issues where event filter settings appeared stale or inconsistent after changes have been addressed. Saved audit log event filter settings are now invalidated across running processes, and the settings read path reflects the latest saved configuration more reliably. This improves confidence when administrators use “Log only selected events” or “Log all except selected events” to reduce audit log noise.

• Audit log filtering controls now better preserve administrator intent. AIR improves handling around audit event selection modes so administrators can switch between logging modes with less risk of losing or misapplying selected event filters.

• Outbound connector validation has been hardened across AIR Console integrations. AIR now applies a secure-by-default outbound destination validator to Console-initiated requests, including Git repository validation, event subscriptions, evidence repository validation, directory services validation, syslog validation, proxy validation, and related connector checks. SaaS deployments block non-public and cloud-metadata destinations, while on-premise deployments preserve legitimate internal connectivity with configurable allow-list controls.

• Investigation Hub query handling has been secured and parameterized. Time-based and second-order query injection paths in Investigation Hub timeline count and finding exclusion-rule workflows have been fixed. Stored values are treated as untrusted at use time, and affected query paths now use safer parameter handling.

• Investigation Hub object-scope checks have been tightened. AIR now enforces authorization more consistently when listing, creating, or applying Investigation Hub exclusion rules and when building asset summary data. This prevents users from expanding results or writing exclusion rules outside their permitted investigation scope.

• Stored script execution in Investigation Hub asset filters has been fixed. Asset and assignment names displayed in the Evidence Assets filter are now escaped before highlighting. Server-side validation was also added to prevent unsafe asset-name input in section creation workflows. This protects analysts from stored script execution when viewing investigation report-generation filters.

• Investigation Hub search results now open records more reliably on large datasets. AIR optimized the search-to-grid path so selecting artifact search hits is less likely to result in a timeout or an empty records view when matching data exists.

• The “New evidence has been added” toast no longer appears incorrectly for task-assignment investigations. AIR now suppresses this notification for investigations that are permanently scoped to a single task assignment, avoiding confusion when the initial import completes while an analyst is already viewing the Investigation Hub.

• Findings CSV export no longer duplicates the “Flags” column. Exported findings now contain a single human-readable Flags column, allowing the CSV to be re-imported without duplicate-header errors.

• The Platform “Add to Filter” action in finding details now creates a valid advanced filter. AIR now falls back to an allowed operation when the requested filter operation is not supported by the selected field.

• Remote repository browsing no longer shows stale results during rapid search or navigation. AIR now ignores superseded repository list responses so slow responses from earlier requests do not overwrite newer search results.

• Date pattern changes no longer fail because of unchanged profile name fields. Date and time preference saves now submit only the relevant preference data, so users with identity-provider-managed names containing restricted characters can still update date formatting.

• Additional month-first date formats are now available. Users can choose formats such as month/day/year and month-day-year variants from Date & Time Preferences.

• Invalid license keys now produce clearer validation messages. AIR no longer reports a license server connectivity problem when the server is reachable and the actual issue is an invalid or missing license key.

• PFX import no longer exposes the PFX password in the URL. The certificate import modal prevents native form submission and keeps sensitive certificate passwords out of client-visible locations.

• The “Deploy your first Responder” button now updates correctly on new tenants. The empty asset page now reflects current permissions and license features reactively, so eligible administrators can start deployment without refreshing or navigating away.

• Responder reinstall handling on Linux has been improved. AIR addresses a scenario where an older Responder process could remain running after uninstall and block the newly installed service from starting because the previous process still held the runtime lock.

• Responder updates are safer for NAT-dependent Linux workloads. A startup cleanup path that could briefly reset established network flows on certain Linux hosts has been fixed. Customers running affected Responder versions should upgrade to the fixed Responder release before resuming automatic updates on sensitive clustered workloads.

• DRONE no longer reports unrelated USB or smart card driver events as event log clearing. Event classification now checks the provider, reducing false positives in Windows event analysis.

• A restrictive Permissions-Policy response header has been added. AIR now explicitly disables access to browser features such as geolocation, camera, microphone, payment, USB, and motion sensors unless they are intentionally enabled in the future.

• Console-initiated outbound requests now sanitize failure behavior more consistently. Connector validation paths no longer rely on inconsistent destination filtering, reducing internal reachability exposure in SaaS environments.

• API token metadata visibility has been improved for integrations. External consumers can retrieve token details such as expiration date, enabling better token renewal warnings and reducing failed automation caused by expired credentials.

• Background worker consistency for audit logging has been improved. Multiple Console containers and workers now receive audit log setting changes more reliably, reducing discrepancies between saved settings and logged events.

What’s New?

• Expanded Windows event collection coverage: Acquisition profiles now include additional relevant Windows Event IDs. This increases visibility into activity that may be important during security investigations and retrospective analysis..
• Improved interACT file download experience: interACT command result downloads now include file size information, enabling progress indication for larger files and improving the experience for analysts and external integrations.
• Investigation Hub usability improvements: A Toolbox button is now available in the Investigation Hub header, making related investigation actions easier to access during active case review.

New Features & Improvements

Responder and Task Execution

Expanded Windows Event Collection Coverage

AIR acquisition profiles now include additional Windows Event IDs that are relevant to security investigations. These additions improve coverage for event-based review and help analysts identify activity that may otherwise require manual profile updates.

Administrators can use the updated acquisition configuration as part of standard evidence collection workflows. The expanded event coverage supports stronger timeline reconstruction and better evidence-backed decisions during post-incident investigation.

Investigation Hub

Toolbox Access from the Investigation Hub Header

The Investigation Hub header now includes a Toolbox button. This makes supporting actions more accessible while analysts are reviewing evidence, findings, and artifacts inside a case.

By reducing navigation friction, the change helps analysts stay focused on the active investigation context and move more quickly between review and response actions.

interACT

Improved Command Result Downloads

interACT command result downloads now include the content length in the response. This allows browsers and integrations to display accurate progress for larger downloads.

The improvement is useful when analysts retrieve larger command outputs or files through interACT. It reduces uncertainty during downloads and provides a clearer indication that the file transfer is progressing.

Bug Fixes

• Responder startup no longer disrupts Linux connection tracking when isolation was not used. A Linux Responder startup path could clear host connection tracking during upgrade or service restart, even on assets where network isolation had never been used. This could briefly disrupt NAT-dependent clustered workloads. The cleanup now runs only when isolation artifacts are present, preserving normal network state during routine Responder updates.
• Acquisition now stops immediately on disk-full write errors. When a collector encounters a no-space-left condition during evidence collection, AIR now cancels the acquisition pipeline immediately instead of allowing additional collectors to continue failing and generating excessive logs. This reduces wasted processing and improves clarity when an asset lacks sufficient disk space.
• Console proxy settings are now applied to license validation in on-premise deployments. License validation now respects the configured Console proxy. This resolves failures in environments where outbound internet access must pass through a proxy and avoids misleading situations where proxy verification succeeds but license validation bypasses the proxy.
• RelayPro registration now works correctly in multiport Console configurations. RelayPro agent-facing registration and communication endpoints are now accepted through the supported Responder communication path. This resolves 403 “Console Port Forbidden” errors that prevented RelayPro from registering in affected on-premise configurations.
• Fresh installations now create the required File Explorer processor configuration. AIR now creates the required File Explorer processor during installation. This resolves Repository Explorer failures where the supporting service was healthy but AIR reported that the processor was not configured.
• Investigation Hub export URLs now resolve correctly. The Investigation Evidence Export Request API now returns a usable download URL. API users can create an export request and retrieve the generated CSV instead of receiving a 404 response from the returned URL.
• Investigation Hub filtering has been improved for large findings datasets. The Flag “Is blank” advanced filter has been optimized so large findings views do not become unresponsive or fail because of long-running queries. This improves review workflows for cases containing a high volume of findings.
• Artifact data now remains visible when filtering by affected assets. AIR fixed an Investigation Hub issue where artifact data could disappear from the left-side panel after applying certain asset filters. Clearing filters is no longer required to restore the artifact view.
• Investigation Hub evidence relationship handling has been corrected. AIR fixed an issue that affected evidence relationship display and correlation inside Investigation Hub, improving consistency when analysts review linked artifacts and findings.
• Advanced filter value lists now show expected available values. AIR fixed an issue where some valid filter values did not appear in Advanced Filter controls across areas such as Assets and Tasks. Analysts and administrators can now select available environment values more reliably.
• Asset selection now matches the task scope for Triage tasks. AIR fixed an issue where the selection count could include assets selected across multiple filtered views, while the resulting Triage task only processed assets from the latest filter view. Task creation now better reflects the intended asset selection.
• Disk Image and Repository Explorer search behavior has been corrected. Search filtering now works more reliably when selecting repositories or browsing disk image lists, helping analysts locate relevant evidence sources faster.
• PFX certificate import messaging and trust handling have been improved. AIR now handles PKCS12 certificate conversion and certificate chain validation more reliably, with clearer guidance when certificate trust issues are detected.
• License error messages now better reflect the actual condition. AIR now provides more accurate license validation feedback, reducing confusion between capacity-related conditions and connectivity problems.
• MITRE notification formatting has been corrected. Analyzer database change notifications now render more cleanly, improving readability for administrators reviewing update information.
• Bulk case closure now reduces load on cache services. AIR no longer proactively scans and removes large numbers of investigation jobs when a case is closed. Job processors now check case state when processing and skip work for closed cases, reducing load during bulk closure operations.
• Task assignment reads no longer include large response payloads by default. AIR avoids loading large task assignment response data unless needed. This improves performance in environments where task responses contain large JSON bodies, such as auto asset tag responses.
• Auto-tag organization isolation has been corrected. Auto asset tags are now filtered by organization during assignment and scheduled processing. This prevents tags configured for one organization from appearing in another organization’s cases or assets.
• Security and authorization hardening has been applied across tenant-scoped workflows. AIR corrected cross-organization authorization gaps in Investigation Hub advanced filters, finding exclusion rules, and asset tag deletion. These fixes strengthen tenant boundaries and prevent unauthorized cross-organization modification of saved searches, exclusion rules, and tags.
• Audit log filtering has been hardened. AIR now safely handles user-supplied audit log filter keys, preventing unsafe query construction while preserving existing filtering behavior.
• SSO provider data remains current after configuration changes. AIR now invalidates cached SSO provider data when providers are created, updated, or deleted, ensuring administrators see current authentication configuration.
• Integration settings load more efficiently. AIR improved integration settings retrieval performance, reducing delays for administrators working with cloud and repository integrations.
• Setup and role seeding reliability has been improved. AIR fixed a race condition between setup and predefined role seeding, improving reliability during installation and provisioning.

What’s New?

• Expanded Windows Clipboard History visibility: AIR now surfaces Clipboard History and Clipboard Activity artifacts in Investigation Hub. This helps analysts review copied text activity, user workflow context, and clipboard-related evidence when investigating suspicious behavior on Windows assets.
• S3-compatible evidence repository support: AIR now supports custom S3-compatible storage providers, including common object storage platforms that use S3-compatible APIs. This gives security teams more flexibility when storing collected evidence in restricted, hybrid, or customer-managed environments.
• Improved export workflows for reporting and correlation: Export behavior has been expanded with configurable CSV delimiters, UTF-8 BOM support, timezone options, and column-selection-aware exports. Analysts can now generate cleaner, locale-compatible outputs that better match what they see in AIR.
• Configurable audit logging: Administrators can now control which audit events are written to the Audit Log. This helps reduce noise, focus on high-value security events, and support compliance-driven monitoring requirements.
• More controlled auto asset tagging: Auto Asset Tagging can now be managed more selectively, allowing teams to enable or disable specific tagging rules. This helps SOC and MSSP teams apply automation more precisely across different customer or organizational environments.

New Features & Improvements

Investigation Hub

Investigator Toolbox for In-Hub Analysis

Investigation Hub now includes entry points for an Investigator Toolbox from evidence detail views. Analysts can open selected field values in the toolbox directly from the evidence context, reducing the need to copy values into external utilities during an investigation.

This improvement supports faster evidence review by keeping common analysis actions close to the data. Values such as encoded strings, timestamps, hashes, IP addresses, domains, registry paths, and other artifacts can be reviewed with less context switching.

For investigation teams, this improves continuity during evidence-based investigations. Analysts can move from observation to enrichment more quickly while preserving the context of the case and the original evidence item.

Export Options for Investigation Reporting

AIR export workflows now provide more flexibility for teams that rely on CSV outputs for reporting, correlation, and downstream analysis. Exports can be configured with delimiter options such as comma, semicolon, tab, or pipe, and can include UTF-8 BOM support for improved compatibility with regional spreadsheet settings.

This is valuable for organizations using Turkish or European locale settings, where spreadsheet tools may expect semicolon-separated files. Analysts can produce files that open correctly without manual conversion steps.

Export workflows also include timezone-related controls for Investigation Hub flag exports, helping analysts generate outputs that match investigation and reporting requirements across different operating regions.

Exports Now Respect Visible Column Selection

Non-Investigation Hub exports now support exporting the columns currently visible in the UI. When analysts hide columns through column selection, exported CSV files can now reflect that visible selection instead of always exporting every available column.

This improves data minimization and reporting accuracy. Analysts can export only the fields needed for a report or handoff, reducing unnecessary internal identifiers, sensitive values, or irrelevant operational data in exported files.

Evidence Collection

Windows Clipboard History Evidence

AIR now integrates Windows Clipboard History evidence into the acquisition profile and Investigation Hub. Clipboard History and Clipboard Activity are available as Windows artifact sources, with parsed activity status values displayed in a readable format.

This helps analysts review clipboard-related user activity when Clipboard History is available on the asset. Clipboard evidence can support investigations involving copied commands, copied URLs, copied identifiers, or other text values that may be relevant to adversary techniques or unauthorized activity.

The new evidence appears in Investigation Hub under the Windows evidence navigation structure and uses the standard evidence grid experience. Analysts can review, filter, and correlate clipboard-related records with other collected evidence in the same case.

Evidence Repository and Storage

S3-Compatible Evidence Repositories

AIR now supports a dedicated S3-compatible evidence repository type. Administrators can configure a custom endpoint, provider name, and region for object storage platforms that use S3-compatible APIs.

This expands evidence repository options beyond standard cloud storage configurations. Organizations using providers such as Backblaze B2, Pure Storage, MinIO, Wasabi, Cloudflare R2, or similar S3-compatible services can configure evidence upload destinations more directly.

Custom Azure Blob Storage Domains

AIR now supports custom Azure Blob Storage domains in evidence repository configuration. This addresses environments that use custom storage domains instead of the standard public Azure Blob Storage domain format.

This is important for organizations operating in restricted or contained network environments. Administrators can configure storage destinations that match their network architecture, allowing acquisition workflows to upload evidence without requiring workarounds.

Evidence Repository Filtering, Sorting, and Last-Used Details

Evidence repository lists now provide improved filtering and sorting for S3-compatible providers. Repository type and provider values are handled more consistently, including provider names entered as free text.

Repositories can also be sorted by last-used information, helping administrators quickly identify active storage destinations and review repository usage patterns. This is useful in environments with multiple organizations, storage providers, or regional evidence destinations.

Access, Authentication, and Governance

SSO Custom Claim Mapping

Administrators can now define custom claim mappings for SSO providers. AIR supports mapping identity provider attributes to expected AIR fields such as email, first name, last name, and groups.

This improves compatibility with identity providers that use different claim or attribute names. Administrators can adapt AIR to existing identity configurations without requiring custom changes or provider-specific workarounds.

The improvement supports both OIDC and SAML-based SSO configurations and helps enterprise teams integrate AIR into established authentication environments more efficiently.

Self-Service 2FA Device Change

Users can now change their authenticator device through a guided self-service flow. The user verifies the current authenticator code, scans a new authenticator secret, and confirms the new code before the old secret is replaced.

This provides a graceful transition when users replace a phone, move to a new authenticator application, or update corporate devices. The old authenticator remains valid until the new one is verified, so the account does not lose 2FA protection during the change.

Personal Access Token Access Control

AIR now includes a dedicated privilege for managing personal access tokens. Administrators can control whether users can view, create, edit, or delete personal access tokens.

This gives security teams more precise control over API access and automation credentials. Organizations can limit token management to approved roles while preserving existing operational workflows for users who require token-based integrations.

Configurable Audit Logging

Administrators can now configure which event types are written to the Audit Log. The new event filter supports logging all events, logging only selected events, or logging all events except selected events.

This helps teams reduce audit noise and focus on activity that matters most to their governance, compliance, and security monitoring requirements. Changes to audit logging configuration are themselves recorded, helping maintain traceability over audit policy changes.

License Usage Banners

AIR now provides clearer license usage notifications through visible banners at higher usage thresholds. These banners help administrators understand when asset usage is approaching important license limits.

Asset and Task Management

Selective Auto Asset Tagging Rules

Auto Asset Tagging can now be controlled at the rule level. Administrators can enable or disable individual rules instead of relying only on a global auto-tagging switch.

This helps teams run only the tagging rules that are relevant to a specific environment, organization, or customer. MSSP teams can reduce noisy tagging behavior and test new rules without activating every rule in the library.

Bug Fixes

• Investigation Hub advanced filters: Fixed an issue where invalid filter options could appear for some columns in the advanced filter panel.
• Investigation Hub exclusion activity: Fixed an issue where exclusion rule creation activity was displayed incorrectly and was not clickable in the Activity view.
• Investigation Hub flags after organization changes: Fixed an issue where incorrect flags could be shown or assigned after changing an investigation organization.
• DRONE analysis rerun at scale: Fixed a case-level DRONE re-analysis workflow that generated one request and one toast per asset assignment. The workflow now batches the action more effectively and shows a single summary notification, improving usability in large cases.
• Exclusion rule modal usability: Improved the Exclusion Rule modal layout so action controls remain accessible on common screen sizes and users do not need to search for the submit action inside the scroll area.
• Exclusion toast behavior: Exclusion confirmation toasts now auto-dismiss after a short duration instead of remaining on screen indefinitely.
• Export timestamp precision: Fixed an issue where some exported date and time formats did not include seconds. Exported timestamps now provide consistent precision across supported timezone options.
• Matched policies after isolation actions: Fixed an issue where the Matched Policies section disappeared after isolate or unisolate actions until the page was refreshed.
• Policy search: Fixed an issue where searching on the Policies page did not filter the displayed policy list.
• Cases page search field: Fixed a UI issue where the search input on the Cases page was too narrow, making typed text difficult to see.
• Task Details table spacing: Adjusted default table spacing on the Task Details page to improve readability and screen usage.
• interACT REST polling: Fixed an issue where public interACT REST API polling could continue returning an in-progress state after the command had already completed.
• MITRE ATT&CK database version validation: Fixed an issue where the API accepted a non-existent MITRE ATT&CK database version before task creation. Invalid versions are now validated earlier.
• Backup restore completeness: Fixed an issue where a backup archive could miss the primary database dump in larger environments, causing restore results to appear incomplete in the UI.
• Backup creation options: Removed a misleading unused database option from the backup creation workflow to reduce confusion and avoid unnecessary backup size growth.
• Application health after install or upgrade: Fixed a health check validation issue that could cause an application container to be reported as unhealthy after a fresh installation or upgrade.
• Evidence repository configuration: Fixed and refined S3-compatible repository form behavior, provider display, and save handling for repository configuration workflows.
• Custom Azure Blob Storage validation: Fixed validation so custom Azure Blob Storage domains can be used where supported by the evidence repository configuration.

AIR v5.18 focuses on faster investigation workflows, stronger large-environment scalability, improved responder communication, expanded MITRE ATT&CK database management, and more flexible isolation controls. This release helps cybersecurity and investigation teams work across large asset estates with greater confidence, while giving administrators more control over authentication, evidence repositories, policies, and operational visibility.

What’s New?

• Structured Data Viewer for JSON, XML, and YAML: AIR automatically identifies structured content within evidence and opens it in a dedicated viewer. Analysts can collapse, search, and format data for clearer insight into complex artifacts like system logs or Tornado data.

• Policy Cloning: Users can now duplicate any existing isolation or acquisition policy. This streamlines the creation of consistent policies across organizations or investigation scenarios, reducing configuration errors and setup time during critical incident response actions.

• Bulk Import for Isolation Policy Allow Lists: Analysts can now import IP/Port or process allow lists in bulk through text or CSV input, expediting creation of large-scale isolation rules for controlled response actions.

New Features & Improvements

Investigation Hub

Structured Data Viewer – JSON, XML, and YAML

Evidence items that contain structured content can now be examined through a dedicated viewer. When AIR detects JSON, XML, or YAML, users can click View to open a read-only panel that uses syntax highlighting, search, wrapping, and toggling between raw and formatted modes.

This improves readability of system logs, Event Viewer exports, or Tornado-acquired data, helping analysts to interpret data formats natively rather than extracting them externally. The viewer maintains forensic integrity while improving interpretability for complex datasets.

Settings

User Visibility Enhancements

The Users table now contains fields for Created (user registration date) and Last Active (last console interaction). These additions clarify differences between login time and real-time console presence. Analysts and administrators can now see both authentication events and continuous activity, supporting audit and compliance tracking.

The “Created” column is sortable, which helps identify new or potentially unauthorized accounts swiftly. “Last Active” reflects the last heartbeat signal received from a user’s browser session, providing insight into actual system usage.

Syslog Configuration Persistence

Syslog configuration updates now apply dynamically without restarting the console. This ensures uninterrupted log forwarding when updating integrations with SIEM or log management platforms during active operations.

Policies

Policy Duplication

Policy creation has been simplified with a new Duplicate action, allowing analysts to clone existing policies, including all filters, allow-list entries, and organization assignments. This is particularly valuable for large enterprises with complex, standardized configurations across multiple operational units.

To use this feature, open the Policies view, select a policy row, and choose Duplicate. The new policy opens prefilled with the selected configuration, ready for minor adjustments. It significantly reduces preparation overhead when adapting response templates across environments.

Bulk Import for Isolation Allow Lists

Isolation policy configuration now supports bulk entry for IP/Port and process allow lists. Investigators can paste or import multiple rows directly into the configuration dialog, where AIR validates and structures the entries automatically. This improves efficiency for incident containment planning, allowing immediate deployment of network or process restrictions at scale.

Assets & Task Management

Asset List and Tagging Stability

Asset list rendering performance has been optimized for high-scale environments with hundreds of online assets. Tag updates, search, and filtering now remain consistent during background polling, ensuring dependable management of large connected fleets.

Creation Date Filters for Tasks

A new “Created At” filter enables analysts to view tasks executed within a specific date or time range. This is useful when correlating console performance or task behavior across simultaneous acquisitions or hunts, particularly during post-incident review.

DRONE Analyzer State Synchronization

When DRONE’s global toggle is disabled during task configuration, all individual analyzers are now correctly deselected. This clarifies configuration state and prevents unintentional analyzer execution.

Responder and Evidence Collection

Disk Space Validation Improvements

The Acquisition Task behavior for disk space thresholds has been updated to ensure decimal input values are handled safely. Analysts can now enter size limits more intuitively without risking misinterpretation during collection jobs.

Enhanced Failure Feedback in Acquisition Tasks

Failure messages during partially completed acquisitions now include clear context about missing or inaccessible evidence, aiding interpretation of collection outcomes and simplifying troubleshooting during live operations.

macOS Deployment Guidance

The macOS deployment instructions now include a “Do Not Change Filename” advisory, aligning with Windows packaging consistency to prevent deployment misconfiguration for responders installed in secure macOS environments.

Investigation Management

Improved Data Export Performance

Exports from the Investigation Hub now cache JSON keys, improve view materialization, and reduce redundant lookups, dramatically enhancing performance when exporting findings from large-scale investigations. Analysts working with hundreds of assets and thousands of findings will experience significant speed gains during CSV export.

Bug Fixes

• Evidence Repository Validation: The system no longer performs repository connection checks during interACT task setup when no repository is selected, ensuring consistent and logical validation behavior.

• Asset Polling Instability: Asset tags, filters, and column selections now remain stable during polling cycles with hundreds of online assets, preventing data flicker or loss of user selections.

• Syslog Configuration: Configuration updates are now applied immediately without requiring a restart, ensuring uninterrupted event forwarding.

• DRONE Analyzer Toggle: Disabling the master DRONE analyzer now correctly resets each individual analyzer switch in the task creation form.

• Decimal Disk Space in Policy: Acquisition tasks accept fractional disk space entries and standardize size representation across the UI and backend.

• Windows DNS Evidence: Evidence collection for Windows DNS Server is restored to return expected results, improving visibility during network infrastructure investigations.

• User Interface Corrections: Search results no longer display disabled configuration options, and column selections persist as expected when navigating between asset views.

• Partial Task Status Clarity: Improved error messaging now differentiates between fully failed acquisitions and partially completed evidence collections to reduce confusion in investigation reports.

What’s New?

• AIR File Explorer XFS Partition Support: Added support for recognizing and parsing XFS partitions in disk images. Analysts can now browse and analyze evidence from XFS-based assets directly within AIR File Explorer.

• Expanded Windows evidence coverage in Baseline Comparison: Baseline Comparison is enhanced with support for 40+ new Windows evidence sources, along with new section constants and table-to-section mappings to extend comparison coverage across file system activity, registry artifacts, system and network data, SRUM, and other forensic evidence sources. macOS section constants and mappings were also reformatted for improved consistency.

• Enhanced RelayPro: Upgraded RelayPro with a new toolchain and dependency improvements enhances responder–console communication security and reliability. This ensures uninterrupted evidence transfers and more resilient responder connectivity during large-scale, distributed investigations.

New Features & Improvements

Expanded Windows evidence coverage in Baseline Comparison

Baseline Comparision coverage was significantly expanded through the addition of more than 40 new Windows evidence items with appropriate identifier fields and ignore fields mappings introduced to support accurate comparison behavior across a broader set of artifacts. To enable these new evidence types throughout the comparison pipeline, 12 new Windows section constants and related table-to-section mappings were also added. In addition, macOS section constants and table mappings were reformatted for more consistent alignment and improved maintainability.

The newly supported Windows evidence sources were added across multiple investigation areas, including file system and user activity artifacts such as crash dumps, recycle bin, system restore, downloads, shell bags, LNK files, and jump list data; registry artifacts such as AppCompatCache, UserAssist, Recent Docs, Typed URLs, Office MRU, and Open/Save MRU; system and network data including processes, TCP/UDP tables, ARP table, and volumes; SRUM-based usage artifacts covering application, network, timeline, energy, and connectivity data; and other high-value sources such as Amcache, browser downloads, dependency manifests, PowerShell ConsoleHost history, and user access logs. Through this expansion, broader visibility into Windows activity and configuration data was enabled, allowing change analysis to be performed with greater depth and consistency.

AIR File Explorer XFS Partition Support Improvements

Full disk images containing XFS partitions can now be opened in AIR File Explorer, and file types within those partitions are displayed correctly. This improvement was implemented to address cases where XFS-based evidence could be accessed, but file type information was not visible, limiting file review and triage during investigations. With this enhancement, evidence stored on XFS partitions can be examined more effectively, enabling faster validation of file contents and improving confidence in incident analysis for security analysts.

Responder Communication Optimization

RelayPro Dependency and Toolchain Upgrades

This release introduces an updated RelayPro component version that enhances responder–console communication reliability and strengthens encryption handling. The updated communication stack ensures secure transmission during live-response operations and improves failover handling for responders working through restrictive networks.

For investigation teams, this means greater confidence in evidence integrity and session reliability during real-time analysis or containment workflows. RelayPro’s enhanced dependency security reduces the risk of communication errors, ensuring uninterrupted connectivity between distributed responders and the AIR Console.

Prevent Avoidable HTTP Requests from Responder

Optimizations have been added to reduce redundant responder–console communication. Responders now suppress duplicate status reports and disable unnecessary retry attempts when a request fails with permanent error conditions (for example, 404, 403, 401 responses). This improvement reduces network overhead during widespread deployments and speeds up recovery during transient connectivity disruptions.

Bug Fixes

• Incorrect Task Status Display: Resolved an issue where task statuses under Cases → Tasks appeared inconsistent when the main task was cancelled. Statuses now correctly reflect task outcomes across all views.

• Proxy Configuration Not Applied to External Services: Corrected a defect where AIR Console’s proxy settings did not apply to outbound traffic for feature management and analytics services. Proxy enforcement is now consistent across all external integrations.

• Investigation Hub Report Generation: Fixed a failure that prevented report generation from evidence sources while reports from findings succeeded. Evidence-based reports now generate reliably.

• Acquisition Task Report Loading: Addressed an issue where the Investigation Hub report for certain acquisition tasks remained in a loading state. Reports now open consistently within the console.

• Chrome History Acquisition Integrity: Improved file copy process for the Chrome History database to reduce the risk of corrupted SQLite files, ensuring analysts can examine browser activity with full integrity preservation.

What’s New?

• Enhanced interACT Session Visibility: When reviewing historical interACT sessions, the session header now displays the specific task name, helping analysts quickly identify which live-response session they are reviewing—especially when multiple sessions are open in separate tabs. This enhancement improves investigation context and analyst efficiency.

New Features & Improvements

AIR Settings

Independent Universal Trusted Certificate Store

Analysts and administrators can now securely add and manage Trusted Certificate Authorities directly within the AIR Console. Previously, this capability was restricted under proxy configuration, limiting flexibility for enterprises performing SSL inspection without proxies or those utilizing self-signed certificates. The new implementation introduces a certificate store independent of proxy settings, ensuring forensically sound authentication and minimizing reliance on manual container-level changes.

With this enhancement, organizations using strict SSL inspection or network monitoring can now deploy AIR without interruptions to licensing or updates. This proactive measure enhances compliance and operational continuity in high-security environments.

interACT

Display interACT Task Name in Historic Session Headers

In multi-session environments where analysts review past interACT activities, identifying the correct investigation session can be challenging. AIR now surfaces the task name (for example, “AX-Day2.2”) directly in the session header and browser tab. This improvement enhances visibility and supports faster navigation between concurrent evidence reviews.

For investigation workflows, this means analysts can immediately differentiate and correlate live-response sessions without confusion, improving auditability and speed during case validation or retrospective analysis.

Asset Management

Expanded Asset Filter Options

The Registered At field has been added to the Advanced Filters of the Assets page. Analysts can now filter assets based on their registration timestamp, allowing time-based scoping for both live and historical analysis. This feature streamlines investigation scoping, particularly useful when identifying assets registered during or after a known incident window.

Enhanced Auto Asset Tag Search

Tag search capabilities have been extended to include the content of tags rather than only their names. This improvement increases flexibility when classifying or correlating assets, especially in environments with rich tagging datasets. Analysts can quickly locate assets linked by contextual tag descriptions, enabling faster triage and focused response workflows.

Bug Fixes

• Large Dataset Upload Timeout: Resolved an issue where large acquisition datasets exceeded timeout thresholds during upload or manual PPC processing. Upload stability and dataset handling within Investigation Hub have been improved to maintain continuity across extended acquisitions.

• Windows Volume Imaging Issue: Fixed a Windows-specific image acquisition bug that caused unexpected failures during remote imaging tasks, ensuring consistent evidence capture across platforms.

• “Key Not Found” and Authorization Errors in Console UI: Addressed errors occurring after version upgrades and during access to the Assets > Disk Images menu, affecting console usability and access control verification. Global Admin accounts now have consistent authorization visibility.

• Git Repository Fork Mode Configuration: Resolved a configuration issue preventing edits to repositories in Fork mode where the system incorrectly enforced sync interval parameters.

• AWS Integration Regional Limitation: Corrected the synchronization behavior that was prematurely terminating global scans if a single AWS region returned an explicit deny response. AIR now continues enumeration across other regions unaffected.

• Investigation Hub Data Handling Errors: Fixed the reported null property and missing field exceptions in task processing and data publishing services. These stability fixes ensure that investigation data imports and evidence processing continue without interruption.

• Audit Log Performance Enhancements: Improved the search and pagination performance for audit logs in environments with very large asset counts. Query execution and caching have been optimized to reduce latency and prevent timeout errors.

• Responder Unisolation Feedback: Enhanced feedback visibility during asset unisolation attempts. Responders now display clear status information when unisolation fails or is incomplete, improving clarity during containment and recovery operations.

Binalyze MITRE ATT&CK Analyzer is now at version 13.0.1

Microsoft 365 Detection Enhancements

The DRONE Tornado Analyzer now includes new detections focused on Microsoft 365 event telemetry. Analysts can identify unauthorized configuration changes such as modifications to audit log settings, narrowing of cmdlet auditing, external sharing misconfigurations, and reduced retention policies. These detections are critical for identifying unauthorized administrative activity and potential configuration weakening tactics observed in cloud investigations.

Additional correlation improvements flag brute-force login attempts, missed MFA flows, suspicious OAuth consent grants, and mailbox permission changes commonly associated with persistence techniques in business email compromise incidents.

Sigma Rule Updates

The integrated Sigma detection library has been synchronized with the latest rule updates from the SigmaHQ and Hayabusa repositories. This alignment expands coverage across both endpoint and cloud telemetry sources, bringing enhanced detection insight into unauthorized script execution, privilege escalation, and registry modification behaviors.

MITRE ATT&CK Analyzer / YARA Enhancements

Version 13.0.1 introduces YARA-based detection for Covenant C2 Grunt HTTP stager and implant activities. These additional signatures support early identification of adversary-controlled command-and-control frameworks during evidence analysis, increasing the confidence and precision of post-incident findings.