What’s New?

• DRONE Analyzer Profiles are now available in Libraries. DRONE Analyzer Profiles are reusable, organization-scoped analysis settings for a acquisitions and threat hunts. Analysts can save a named selection of DRONE analyzers, rules, keywords, and scan limits once, then apply that profile when they create an acquisition or threat hunt. A built-in Full profile includes every analyzer and rule in the current catalog. Leaving the profile unset runs the acquisition without DRONE analysis. DRONE Analyzer Profile feature requires AIR Responder v3.5.0 or later. Older versions of responder will not use profile and run the default DRONE analysis.

• Case Dashboard provides a live, case-native, and versioned single source of truth throughout the investigation lifecycle. It brings assets, findings, flags, activities, and participants into one always-available view, helping users preserve full investigation context, quickly understand case outcomes, and conduct post-incident analysis without reopening the case.

• Active Directory asset sync now lives in Integrations. AIR separates LDAP login from Active Directory asset discovery and sync. Asset sync configuration is now organization-scoped, easier to administer, and no longer coupled to global login settings, reducing the risk of unintended asset cleanup when changing authentication settings.

• Evidence Repository management moved into Repository Explorer. Repository Explorer is now the primary place to view, create, edit, and manage repositories. Analysts and administrators can move from repository configuration to repository browsing with fewer context switches.

• Policies are now easier to access and manage. Policies are available as a standalone sidebar entry, and Stale Asset Policies and Removal History now sit under the Policies area. This improves navigation for teams that rely on policy-driven asset lifecycle management.

• Hunt/Triage rule organization is improved for TAXII and STIX content. TAXII-generated Hunt/Triage rules can now create tags from STIX indicator labels, and rule selection grids display tags. This helps analysts quickly understand rule context, prioritize relevant detections, and select the right rules during a security investigation.

• Windows Event Log collection coverage is expanded. AIR adds and refines default Windows Event Log Records coverage across commonly investigated channels such as ESENT, AppLocker, SMBClient, Sysmon, TaskScheduler, and Windows Defender. Analysts get broader visibility into execution, persistence, lateral movement, identity, and defense-evasion activity without first building a custom event ID list.

• Task and asset operations are safer at scale. Large uninstall and uninstall-and-purge actions now require additional confirmation and send a server-side asset-count assertion. This helps administrators avoid accidental responder removal or data purge across large asset sets.

New Features & Improvements

Organization Management and Organization Settings

Active Directory Asset Sync in Integrations

Active Directory asset sync has moved from Settings into Integrations and is stored per organization. LDAP login remains a global authentication setting, while asset discovery and synchronization are managed separately.

This separation reduces operational risk. Disabling global login no longer triggers Active Directory asset cleanup, and each organization can manage its own Active Directory asset sync configuration.

To use this capability, open Integrations, select Active Directory, configure the server, domain, credentials, query, and organizational unit, then validate and save the integration. The Sync LDAP action now reports connection and sync status more clearly, including failed connection states.

Policies and Asset Lifecycle Management

Policies as a Standalone Sidebar Page

Policies are now available directly from the main sidebar. The sidebar order has been updated so Policies sits with other primary operational areas rather than being accessible through Settings.

This improves access for administrators who regularly review collection behavior, asset policies, and policy-driven responder configuration. Legacy Settings policy routes remain available.

Stale Asset Pages Moved Under Policies

Stale Asset Policies and Removal History now appear under the Policies area, with a second-level navigation structure. Old Settings URLs redirect to the new Policies paths.

This places asset lifecycle controls next to other policy-driven workflows, making it easier to review stale asset removal behavior and historical cleanup activity.

Large-Count Confirmation for Uninstall and Purge Actions

Uninstall Agent and Uninstall Agent & Purge now use the same large-count safety pattern as large task assignments. When an action targets a large number of assets, the UI requires an explicit confirmation and sends the confirmed count to the Console.

This protects administrators from accidental responder removal or data purge across large asset sets. If the asset count changes after confirmation, the Console can reject the request before the action starts.

Evidence Repositories and Repository Explorer

Evidence Repository Management in Repository Explorer

Repository Explorer is now the primary location for evidence repository management. The page includes an All Repositories view, typed repository lists, and edit routes for repository details.

Operators can manage repository connections from the same area used to browse evidence repositories. This reduces context switching and makes it easier to resolve repository connection issues from task flows, Quick Start links, and command bar navigation.

The legacy Settings URL for Evidence Repositories remains reachable, but it is no longer listed in the Settings navigation.

Azure Blob Search in Repository Explorer

Repository Explorer search now filters Azure Blob repository contents correctly. AIR maps the datagrid search term to the query parameter expected by the repository listing service.

This improves repository navigation when working with large external evidence stores. Analysts can search by file name and reduce time spent manually browsing deep repository paths.

Hunt/Triage, TAXII, and DRONE

Create Hunt/Triage Tags from STIX Indicator Labels

TAXII and manual STIX feeds can now create Hunt/Triage tags from STIX indicator labels when the feed-level option is enabled. AIR creates label-derived tags with a dedicated prefix and applies them only to the generated rule batch they belong to.

This helps analysts distinguish automatically generated rules by threat context, campaign label, or source classification. It also reduces manual tagging work when ingesting large volumes of threat intelligence.

To use this feature, enable Create tags from indicator labels in the TAXII feed conversion settings. Generated Hunt/Triage rules will include the label-derived tags alongside existing TAXII provenance tags and any operator-defined tags.

Rule Tags Displayed During Hunt/Triage Selection

The Hunt/Triage rule selection grid now displays tags for rules. This gives analysts more context before starting a task, especially when working with rules generated from TAXII or STIX feeds.

Tags help analysts select rules relevant to the current case, reduce accidental over-selection, and improve consistency across repeated investigation workflows.

Expanded Windows Event Log Records Collection

The default Windows Event Log Records configuration now includes broader coverage across common investigation channels and providers. Updates include ESENT, AppLocker, SMBClient, Sysmon, TaskScheduler, Windows Defender, and additional event descriptions for clearer analyst interpretation.

This improves out-of-the-box visibility for identity activity, execution, persistence, defense evasion, lateral movement, removable device usage, and system changes. Analysts can rely on a broader default event set without first auditing common event IDs manually.

DRONE Analyzer Profile

DRONE Analyzer Profiles live under Libraries, next to acquisition profiles. Each profile has two steps; Analyzers and Configurations. Analyzers step is where users name the profile, choose its organizations, and define what DRONE should look for:

• Keywords, typed in or imported from a text file, with a total match limit and a per-analyzer match limit.

• Analyzers and their rules for Windows, Linux, and macOS, grouped by MITRE ATT&CK tactic.

Configurations is the last step where users can configure advanced settings:

• Minimum finding severity (low, medium, or high).

• Global path exclusions

• YARA scanning of files on disk and of running process memory

• Windows event log analysis: how far back to read, plus total, per-channel, and per-rule limits.

• Linux syslog analysis: total and per-file size limits, and a per-rule match limit.

• macOS audit log analysis: a total event limit and a per-rule match limit.

DRONE Analyzer Profiles are also aligned with shared profile usage for Hunt/Triage workflows. Analysts can use the selected DRONE Analyzer Profile when running Hunt/Triage tasks.

Task Execution, Responders, and Asset Operations

Responder Task Queue Resilience

Responder task execution is more resilient when a child process stops exiting. AIR decouples task queue slot lifetime from child process lifetime so that one unrecoverable child process is less likely to block subsequent heavy-lane tasks.

This improves asset-side reliability in difficult environments, including assets with hung filesystem access or long-running child processes. Investigation teams benefit because later tasks can continue instead of waiting indefinitely behind a blocked queue slot.

Dead-Mount Guard for Collection and Hunt/Triage Walks

Responder-side path traversal now includes guardrails for unresponsive mounts. AIR can probe mount liveness with a timeout and skip unresponsive mount paths during collection and Hunt/Triage filesystem walks.

This reduces the chance that a task becomes blocked by a dead or unresponsive mount. Skipped paths are reported so analysts can understand coverage limitations rather than assuming the collection was complete.

macOS Memory Limit Support

macOS responders now honor memory limits for per-task process trees using a userland watcher. This extends AIR’s resource-control model to macOS assets and helps prevent resource exhaustion during intensive investigation tasks.

Administrators can apply existing memory limit policies with more consistent behavior across supported operating systems.

Task Outcome Notifications for Failed and Interrupted Tasks

AIR now sends task outcome notifications for Failed and Interrupted tasks, in addition to Completed tasks. Notifications apply to in-app notifications and configured channels such as Slack and Teams.

This closes an operational visibility gap. Analysts and administrators can now react to failed or interrupted tasks without waiting for manual task review, while Completed notifications remain unchanged.

Maximum Execution Time and Process Priority Controls

AIR adds or exposes additional resource controls for task execution, including maximum execution time and process priority where supported. These controls help administrators define how long tasks may run and how they compete with other workloads.

For investigation teams, this improves predictability. Long-running tasks can be bounded by policy, while task priority can be tuned to balance evidence collection with business workload impact.

API and Integrations

Expanded API v2 Coverage

API v2 coverage has been expanded across several investigation and administration workflows, including parameters vocabulary, organization onboarding, asset tag rules, baseline acquisition and comparison, evidence repository and policy reads, findings summaries, alert triggers, event subscriptions, audit logs, task lifecycle, off-network packages, and asset PPC download.

This enables administrators, service providers, and integration teams to automate more AIR workflows using a consistent API surface. Dry-run behavior is available on mutating operations where appropriate, helping API clients preview impact before applying changes.

Alert Triggers and Event Subscriptions

API v2 now supports webhook trigger and event subscription workflows. Trigger URLs are treated as credentials and are masked by default. Event subscription tokens remain write-only, and test operations use stored configuration rather than caller-supplied URLs.

This supports safer integration between AIR and external detection or notification systems while reducing the risk of unintentionally exposing integration secrets.

Off-Network Package APIs

API v2 adds off-network package creation and retrieval for collection workflows where AIR cannot directly reach an asset. Package handles are signed, scoped, and time-limited.

This helps teams integrate off-network workflows into controlled operational processes while maintaining authorization boundaries around package retrieval and evidence archive password derivation.

Audit Logs and Task Lifecycle APIs

API v2 now includes audit log listing and export, plus task listing and task cancellation. Audit log details redact credential-shaped fields by default, and task cancellation supports dry-run preview with assignment counts.

These improvements help administrators build safer operational tooling around investigation history and task control.

Navigation, Usability, and Operator Experience

Policies and Repository Explorer Navigation

The console sidebar now includes Policies as a standalone page, and Evidence Repositories are managed from Repository Explorer. These navigation updates reduce the number of steps required to reach commonly used administration and evidence storage workflows.

interACT Wait Estimate

interACT wait messaging now shows the estimated wait time while AIR is waiting for session assignment, not only when the responder is not connected. This gives analysts clearer feedback during live-response setup.

Case Dashboard

The Case Dashboard is the home view of a case now, provideing a live, case-native, and versioned single source of truth throughout the investigation lifecycle. It brings assets, findings, flags, activities, and participants into one always-available view, helping users preserve full investigation context, quickly understand case outcomes, and conduct post-incident analysis without reopening the case.

While a case is open, it shows a live summary of the investigation: assets, evidence, findings, flags, tasks, activity, and participants. When the case is closed, dashboard will be a saved snapshot of the investigation at the time of closure, together with the closure reason and the narrative the team records. The report can be exported to PDF, and its findings, flags, and assets can be exported for the record.

Bug Fixes

• Investigation Hub import stability improved for large disk-image evidence. AIR now yields during SQLite-to-Investigation Hub imports so large evidence imports are less likely to block the Console event loop. This reduces the chance of repeated restarts and stalled imports when processing large Case.db files.

• Investigation Hub import now handles deleted assets safely. If an asset is deleted before task data import starts, AIR now marks the assignment as Error and returns instead of crashing the task-data processor and clogging the import queue.

• Investigation Hub full-text search sequence exhaustion fixed for new schemas and migration paths. AIR widens the full-text search identifier sequence to reduce the risk of ingest failures after high-volume or repeated imports. This helps preserve search availability in long-running investigations with large evidence volumes.

• Closed cases no longer enter a refresh loop when the close-report feature is enabled. Legacy closed cases without a close-report snapshot now route to a stable case page instead of repeatedly bouncing between case views.

• DRONE Analyzer Profile creation and Hunt/Triage task startup reliability improved. AIR now accepts DRONE catalog rules with longer reference lists and validates catalog compatibility earlier. This addresses cases where the analyzer catalog failed to load or Hunt/Triage task creation returned an error when an existing DRONE Analyzer Profile was selected.

• Responder deployment to GCP assets now reports full-disk failures clearly. When deployment fails because the target VM disk is full, AIR now reports a concise disk-full error instead of returning a long operating-system package manager log.

• Repository Explorer search now works for Azure Blob repositories. File name searches now pass the expected query parameter to the repository listing service, so the grid filters correctly after files load.

• Failed and interrupted task outcomes now generate notifications. AIR now notifies operators about Failed and Interrupted terminal task outcomes across configured notification channels, not only Completed tasks.

• Task and assignment retry authorization was tightened. Retrying failed task assignments now requires the same task-assignment write privilege family used by related lifecycle actions, preventing read-only task viewers from re-queuing work they should not control.

• Baseline comparison authorization was corrected. Starting a baseline comparison now requires the task assignment privilege used for evidence acquisition, matching the fact that the action dispatches work rather than only reading task data.

• Asset assign-task authorization was corrected. Read-only asset viewers can no longer queue asset processing work such as hash calculation. The route now requires asset write or capability-specific assignment privileges.

• Investigation report writes now require case management privileges. Report create, update, delete, and PDF generation routes no longer accept task-view-only access. This protects investigation outputs from unauthorized modification by read-only users.

• Finding exclusion rule creation now requires case management privileges. Users with task-view-only access can no longer add organization-wide finding exclusion rules. Listing and preview behavior remain available to authorized viewers.

• Scheduled task executions now re-check the creator’s current privileges. Recurring scheduled tasks no longer continue to dispatch after the creator loses the required assignment privilege. This improves offboarding and privilege-revocation behavior.

• Cloud deployment filters are now scoped to the caller’s organizations. Organization-scoped users can no longer submit another organization ID in a deployment filter to queue responder deployment tasks outside their scope.

• Organization ID parsing is now consistent across authorization and request validation. AIR now parses organization IDs with a fixed decimal radix in scoped DTOs, preventing alternate numeric encodings from being authorized as one organization and executed against another.

• Case closure field suggestions are now organization-scoped. Reusable close-case field titles no longer leak across organizations, and one organization can no longer delete or plant reusable field titles for another organization.

• All-organizations policy reordering is now protected. Organization-scoped administrators can no longer reorder policies that belong to all organizations through an organization-scoped priority update.

• Outbound URL validation now protects Git repository sync. Git repository creation and background sync now validate outbound URLs before making server-side connections, reducing server-side request risk and aligning Git repository behavior with other outbound integrations.

• TAXII feed creation and discovery privileges were tightened. Low-tier roles no longer receive TAXII feed creation by default, TAXII discovery now requires create permission, and feed owners with create permission can manage their own feeds where appropriate.

• TAXII-generated YARA hash conditions are now validated and escaped. AIR validates file-hash indicator values for the declared algorithm and escapes values before generating YARA conditions, preventing invalid STIX hash values from changing rule logic.

• TAXII and event subscription secrets are hidden from view-only users. Detail routes now omit decrypted credentials and auth tokens for users who only have view privileges. Users with create or update privileges retain the expected edit behavior.

• Dashboard organization summaries no longer expose deployment tokens. The dashboard charts response now returns only the organization fields needed by the UI, preventing secret-bearing organization fields from being serialized in summary data.

• Audit and application log redaction was improved. Query failure logs now redact bind values, long SQL literals, and sensitive database detail fields before serialization. This reduces the risk of customer data, credentials, or evidence content appearing in logs.

• Investigation Hub SQL query protections were strengthened. AIR now blocks PostgreSQL reg-type input functions that could reveal object existence outside the permitted investigation schema.

• Investigation Hub timeline export SQL injection was fixed. Timeline export now validates platform and evidence category identifiers before building SQL and no longer falls back to raw filter input when metadata prefiltering removes invalid sections.

• Investigation Hub data-usage filter SQL injection was fixed. JSON-style filter field names are now restricted to a single column and key, validated per segment, and rejected with a bad-request response when invalid.

• Windows event record export SQL injection was fixed. Event detail keys from uploaded evidence are now validated before being used as exported column aliases, and unsafe keys are filtered during ingest and export.

• Investigation Hub imported evidence now rejects reserved backend-managed columns. Uploaded import rows can no longer set internal identifiers such as AIR-managed row IDs. Backend-managed fields are rejected or stripped before insertion.

• interACT terminal output is now escaped before display. Command output returned by assets is rendered as text before search highlighting is applied, preventing stored script content from running in analyst browsers.

• Acquisition profile Event Log fields are protected against stored script content. AIR now validates Windows event log record fields on create and update, and the UI escapes stored values before highlighting and display.

• Weak or vulnerable UI dependencies were addressed where directly relevant to security findings. AIR upgraded affected UI dependencies associated with sanitized HTML rendering and editor components, reducing exposure to known client-side sanitization vulnerabilities.

• On-premises outbound allowlist behavior was clarified and documented. Empty on-premises outbound CIDR configuration remains permissive for private ranges by design to preserve existing integrations. Operators can still tighten behavior explicitly with a deny setting or a configured CIDR list.

• Organizations panel scrolling was corrected. Organization lists that exceed the visible panel can now be reached instead of being clipped at the bottom.

• Task purge summary logging now reports counts instead of misleading ID buffers. Purge logs now report the number of purged assets instead of a partial or empty buffer of IDs.

• Asset detail lookups now handle null tag arrays. Assets with a null tags column now return an empty tag list instead of causing a server error on ID lookup.

• Investigation Hub data usage calculations are deterministic. Table-size queries now return results in a stable table-name order, reducing test and reporting flakiness.

• Golden CI health checks are more reliable after service restart. The post-setup health wait for the processing service was lengthened and now collects diagnostics on timeout, reducing false failures during image packaging.

• Console component tests recycle workers to reduce memory exhaustion. CI test workers now recycle after reaching a memory threshold, improving reliability of automated validation.

• Local development watch mode is more reliable. Development watch mode avoids unnecessary restarts from unchanged metadata writes and force-terminates hung child processes after a bounded graceful shutdown period.

What’s New?

• Stale Asset Policies for automated asset hygiene. Administrators can now define policy-based Unreachable thresholds and optional cleanup actions for stale assets. This helps investigation teams keep asset inventories accurate, reduce noise, and automatically reclaim capacity when responders have not connected for a defined period. Important licensing change: Assets with an installed Responder will consume a license even when they are Unreachable. Administrators should take this into account when defining stale asset cleanup policies and managing license capacity. For configuration details and additional guidance, see the Knowledge Base.

• Threat intelligence operationalization with TAXII and manual STIX import. AIR can now support manual STIX imports for TAXII feeds, allowing analysts to upload STIX bundles and convert indicators into investigation-ready Hunt/Triage content.

• Console-level Asset Tag Catalog. Administrators can now define shared asset tags at Console level and make them available across organizations. This improves consistency for MSSPs and large teams that need common investigation labels without recreating tags in every organization.

• Expanded AI evidence visibility. AIR now adds AI model inventory support to acquisition profiles and Investigation Hub, helping analysts identify local AI model stores and related artifacts during security investigations.

• Tamper Detected notifications. Responder tampering activity, such as responder stop, removal, or configuration changes, can now be surfaced through configurable notifications. This gives administrators faster awareness of activity that may affect evidence collection or response readiness.

• API V2. Binalyze AIR now includes a redesigned API v2 surface built for automation-first integration across multi-tenant environments. API v2 introduces consistent organization-scoped operations, a unified filter and pagination contract, and safe-by-default mutation handling with dry-run support across write endpoints. v2 is additive and v1 is still fully supported, this is not a migration and there is no deprecation. Comprehensive API reference, guides, and interactive request examples are available in the AIR API v2 Documentation.

New Features & Improvements

Asset & Responder Management

Stale Asset Policies

Stale Asset Policies introduce configurable Unreachable thresholds and optional cleanup actions for assets. Administrators can create custom policies, set how many days of inactivity should mark an asset as stale, and choose whether AIR should take no action, purge the asset from the Console, or purge and uninstall the responder when the asset reconnects.

This feature is designed for teams managing large fleets where inactive assets can create operational noise. By using policy order and filters, administrators can apply different thresholds to different asset groups while keeping a default policy for the rest of the environment.

The feature also includes removal history and CSV export, giving administrators a record of assets removed by automated cleanup. This supports operational review and helps teams understand which assets were removed, when they were removed, and which policy was responsible.

Stale Asset Policies also update the meaning of Managed, Off-network, and Unmanaged status. Being unreachable no longer removes an installed responder from Managed status or license counting by itself. Cleanup policies become the intended method for reclaiming inventory and license capacity from stale assets.

Console-Level Asset Tag Catalog

The Asset Tag Catalog now supports Console-level tags. A tag with All Organizations scope is available across existing and future organizations, while organization-specific tags remain supported.

This is especially useful for MSSPs and large security operations teams that need consistent labels across customers, business units, or environments. Administrators can promote tags to Console level, resolve naming conflicts with confirmation, and keep shared taxonomy consistent across the Console.

Auto Asset Tagging can reuse Console-level catalog tags instead of creating duplicate organization-specific copies, which improves consistency in asset classification and investigation filtering.

Evidence Collection & Investigation Hub

AI Model Evidence Collection

AIR now includes AI model inventory collection in acquisition profiles for supported platforms. The new AI Models artifact source can be included in Full, Compromise Assessment, and AI Evidence Collection profiles.

Investigation Hub displays collected AI model inventory in the evidence navigation and provides row-level details with related task execution logs. This helps analysts identify local AI model stores and AI-related runtime evidence during security investigations.

The collection focuses on inventory and metadata rather than copying large model weights. This gives analysts useful visibility while keeping collection size and operational impact controlled.

Selected Evidence Counts on Acquisition Profile Tabs

Device Acquisition Profile category tabs now show live selected-item counts. Analysts can see how many evidence items are enabled under categories such as System, Memory, Network, Event Logs, Disk & File System, Applications, AI, Custom Content, and osquery.

This improves profile review and reduces the need to open each category to confirm configuration. Counts update as analysts select or deselect artifact sources.

Threat Intelligence, Hunt/Triage & DRONE

Manual STIX Import for TAXII Feeds

TAXII Feeds now support Manual STIX import as a source type. Analysts can create a manual feed and upload a STIX 2.x bundle or JSON object array instead of connecting to a remote TAXII server.

Imports are processed in batches, progress is shown to the user, and a single import produces a sync log with added, updated, skipped, and processed indicator counts.

This improves threat intelligence workflows for teams that receive STIX bundles through offline, partner, or restricted channels. Analysts can operationalize those indicators into Hunt/Triage rules without waiting for a live TAXII connection.

TAXII Feed Rule Source Handling

Hunt/Triage rules generated from TAXII feeds now retain their source correctly during predefined rule reseeding. TAXII-synced rules are preserved as imported content rather than being removed as if they were shipped predefined rules.

The Hunt/Triage Rules grid also identifies TAXII-synced rules as TAXII Feed instead of Manual. This helps analysts distinguish rules created by threat intelligence ingestion from manually authored or Git-synced content.

interACT

interACT Wait-Time Guidance

When an analyst starts an interACT session, AIR now shows an estimated wait time based on the current responder visit interval. The UI also indicates when the wait is taking longer than usual.

This gives analysts better feedback while AIR waits for the asset to connect. If the target asset is offline, the UI shows that state instead of displaying a misleading estimate.

The estimate is informational, not a hard maximum. A busy Console or an offline asset can still make the wait longer.

Settings & Administration

API v2

Binalyze AIR now includes a redesigned API v2 surface built for automation-first integration across multi-tenant environments. API v2 introduces consistent organization-scoped operations, a unified filter and pagination contract, and safe-by-default mutation handling with dry-run support across write endpoints.

Key surfaces include asset management, acquisition and triage task orchestration, interACT remote shell sessions with longer synchronous run windows, Investigation Hub SQL queries with evidence flagging, case and task lifecycle management, and baseline comparisons. A new Fleet predefined role supports least-privilege API token access for automation integrations.

API v2 is additive and v1 is fully supported — this is not a migration and there is no deprecation. Existing v1 public API endpoints remain available and unchanged, including evidence repository, policy, and audit trail access, which have not yet moved to v2.

Comprehensive API reference, guides, and interactive request examples are available in the AIR API v2 Documentation.

Tamper Detected Notifications

AIR can now generate Tamper Detected notifications when a responder reports that it was stopped, removed, or had its configuration changed.

These notifications are available in the notification registry, header popover, and notification history. Users can configure notification preferences from Account > Notification Settings.

This helps administrators respond faster to activity that may affect responder integrity or the continuity of evidence collection.

Tenant-Specific Storage Support for CMEK Deployments

Tenant infrastructure can now be configured to use a dedicated storage bucket and optional customer-managed encryption key. This supports deployments that require tenant-specific encryption controls.

The application continues to use a single configured storage target, while the infrastructure layer controls the bucket and key used by that tenant.

Performance & Scalability Improvements

Responder Request Processing Optimizations

High-frequency responder request validation has been optimized to reduce Console CPU usage on large fleets. AIR now uses compile-once validation on selected responder request paths while preserving the same accepted request shapes and error behavior.

Responder security-token checks now use a dedicated cache path that reads only the token required for authentication, instead of loading full asset records. This reduces cache traffic and improves throughput on responder-heavy deployments.

Additional optimizations reduce unnecessary settings and SSO lookups on common request paths, remove inactive production request logging overhead, and speed up repeated version parsing used in responder update checks.

Bug Fixes

• Policy priority drag-and-drop now works again. Policy rows in Settings > Policies can be reordered with the mouse, and the new order is saved correctly. This restores policy precedence management for administrators who rely on policy order to determine the effective configuration applied to matching assets.

• Manual Responder Update warnings now match the selected assets. The conflict warning shown before a manual responder update now counts running tasks only on the selected assets, not across all manually updatable assets in the organization. This prevents misleading warnings when an operator updates one idle asset while other assets have active tasks.

• Investigation Hub Timeline keeps its scroll position after flagging. Flagging or unflagging a Timeline event no longer resets the view to the top. Analysts can continue reviewing events without losing their place in long timelines.

• The update-check failure notification no longer claims an incorrect 48-hour window. The notification text now states that no connection to the update server could be established, without referencing a duration that the backend does not track.

• Closing a case no longer redirects to the permission page when Close Report is disabled. When Case Dashboard is enabled but Case Close Report is disabled, closing a case now keeps the user on the case instead of loading a report route that the user cannot access.

• Case Dashboard asset counts now align with Case Assets. The Case Dashboard and Closure Report summary now use assignment-linked case asset counts, matching the count shown in the case navigation. The Asset Overview preview remains unchanged.

• License in-use count is refreshed when a purged asset reconnects. When a stale asset is purged and the responder later reconnects, AIR now updates license usage correctly so the in-use count reflects the restored managed asset.

• LDAP group filters now work with backslash paths. Group filters using paths such as domain and child group combinations now match correctly. This fixes cases where valid LDAP group filters returned zero assets because backslashes were escaped for the wrong comparison type.

• The Default Stale Asset Policy drawer can calculate match counts. Empty filters used by the default catch-all policy are now accepted for preview, while custom policies still require valid filter conditions.

• Last Seen is no longer offered as a Stale Asset Policy filter condition. The Stale Asset Policy threshold already uses asset activity time, so removing Last Seen from policy filter predicates prevents confusing or conflicting policy definitions. Save and delete messages now also remind administrators that Unreachable status refreshes within approximately five minutes.

• TAXII-synced Hunt/Triage rules are preserved during predefined rule reseeding. Rules generated from TAXII feeds are no longer removed on Console bootstrap, and their source is shown correctly as TAXII Feed.

• DRONE Analyzer Profile MITRE ATT&CK search now finds rules by name. The MITRE ATT&CK view now searches nested rule and analyzer metadata, not only tactic and technique names.

• MITRE ATT&CK ruleset downloads are more reliable in distributed SaaS deployments. AIR now serves versioned rulesets and DRONE catalogs from shared storage so all Console nodes use the same artifact source.

• Versioned MITRE ATT&CK contract fixtures were aligned. The versioned responder download contract now uses the expected version key and response hash behavior, improving compatibility between Console and responder verification.

• EndpointIsolationStatusUpdatedEvent is now published from modern responder state updates. Isolation status changes reported through responder state requests now emit the same event as other isolation paths, allowing isolation-related automations and status-dependent flows to progress correctly.

• Theme color-scheme handling was corrected. Browser-native UI elements such as scrollbars now follow the selected light or dark theme more consistently.

• Health check handling was fixed for tenantless requests. Tenantless liveness requests no longer fail when tenant context is intentionally absent. This improves operational health checks without changing authenticated tenant behavior.

• Cloud and tenant deprovisioning behavior was improved. AIR now handles scheduled-deleted secrets and duplicate resource identifiers more safely during tenant investigation database deprovisioning, reducing false failure reports and retry loops after successful cleanup.

New Features & Improvements

Investigation Hub

Investigation Hub Performance and Stability Improvements

AIR now bounds large internal evidence-table reads during import, triage, baseline comparison, and DRONE finding workflows. Large evidence tables are processed in controlled pages rather than loaded all at once.

For analysts, this improves reliability when working with large Case data and high-volume evidence sources. It reduces the risk of import or analysis instability during intensive investigations.

Tasks and Asset Operations

Interrupted Task Status, Retry, and Clearer Outcomes

AIR now supports an Interrupted outcome for task assignments and parent tasks when the asset goes away during execution because of a restart, shutdown, Responder update, or service stop. The Responder still reports through the existing task-status channel, and AIR derives the clearer outcome in the Console.

Interrupted assignments are terminal, visible in task views, and retryable. Analysts can see the interruption reason next to the status and retry affected assets without treating the result as a product or task failure.

Task-completed notifications now include interrupted counts when applicable. If a task completed on some assets but was interrupted on others, AIR presents that outcome as partially completed instead of a clean success.

Advanced Filtering for Tasks and Task Assignments

Task lists now support expression-based filtering, bringing the task grid in line with other advanced filtering experiences in AIR. Analysts can filter by task name, creator, type, source, status, execution type, creation time, match state, DRONE data, and rule identifiers.

Task assignment lists also support expression-based filtering. Analysts can narrow assignments by status, asset, match count, DRONE analysis identifiers, evidence availability, import status, progress, and related fields.

This is useful in active investigations where analysts need to quickly locate failed, interrupted, matched, or evidence-bearing tasks across a large operational history.

High-Volume Grid Performance

AIR’s shared data grid now uses virtual rendering for large lists where supported. Instead of rendering every row on the page at once, the grid renders the visible viewport and a buffer.

This improves responsiveness on high-volume lists such as assets, tasks, audit logs, and investigation tables. Existing selection, sorting, pagination, expansion, and row-click behavior are preserved.

Semantic Task Status Colors

Task status colors now map to semantic severity instead of using a unique color per status. Neutral states, active work, success, warning, and error outcomes now use consistent design tokens across task surfaces.

This helps analysts interpret task states faster. For example, active processing states use an information color, completed tasks use success, failed tasks use error, and partially completed or interrupted tasks use warning.

interACT

Longer Synchronous Run Window for interACT v2

interACT v2 synchronous runs now wait up to five minutes for a command result before returning a running handle. The previous wait window was shorter and could move longer-running commands into asynchronous follow-up unnecessarily.

This improves analyst experience when running legitimate commands that need more time to complete. Commands that still exceed the window continue to use the existing running-handle behavior, and interACT v1 behavior is unchanged.

Event Subscriptions and Integrations

Case Reopened Event

Event Subscriptions now include a Case Reopened event. Integrations can subscribe to this event to detect when a previously closed case becomes active again.

This supports case lifecycle automation. For example, an integration that configures evidence storage when a case is open can now restore that configuration when a case is reopened, not only when it is first created.

TAXII Connection Validation Improvements

The TAXII source configuration flow now validates whether the Discovery URI returns a TAXII-compatible response. Plaintext IOC lists or non-TAXII URLs no longer appear as a successful connection.

When a reachable URL is not a valid TAXII source, AIR now provides clearer guidance and a documentation link. This helps administrators distinguish connectivity from protocol compatibility during setup.

Administration, Settings, and API Documentation

Custom Responder User Agents

Administrators can now configure custom Responder User-Agent values for Windows, Linux, and macOS from Settings. The configured values are applied through the Responder configuration path and take precedence when enabled.

This helps organizations with strict proxy policies keep Responder communication compliant without waiting for a new AIR release. The setting is especially useful in environments where proxies block outdated or unapproved browser-identifying headers.

API Documentation and Playground Enhancements

The AIR API documentation has been updated with improved OpenAPI contracts, clearer examples, consistent operation metadata, and safer interactive request execution in the documentation playground.

The hosted API Docs playground can now send non-credentialed requests from the approved documentation origin. Mutation requests require confirmation, and dry-run-capable requests default to preview behavior where supported.

Console-hosted Swagger pages now use the shared Binalyze API documentation interface, including improved navigation, mobile layout, release controls, and branding consistency.

Bug Fixes

• interACT now starts correctly when “Select all items” is used from the Assets page. Previously, the wizard could close without creating any sessions because select-all carried a filter instead of explicit asset rows. AIR now resolves the filter to eligible assets and keeps the wizard open with a clear message if no assets match.

• interACT All tab state is cleared when the last session closes. Command results and command history from a previous run no longer appear after all sessions are closed and a new session set is opened. This also prevents exported interACT reports from including results from unrelated prior sessions.

• Version Update duration now reflects Responder-reported execution time. The Version Updates grid no longer includes the time an asset spent offline before receiving the task. When the Responder reports its measured duration, AIR shows that value in the update history.

• Offline license validation now bypasses the configured outbound proxy. In offline-license deployments, AIR now routes validation to the internal license service directly. This prevents setup and later license checks from failing when a corporate proxy cannot resolve internal service names.

• Large-task confirmation now uses the task’s eligible asset pool. AIR now compares the selected assets against the assets the selected task type can actually target, instead of all assets in the organization. This makes the confirmation dialog appear in cases where a user selects most or all eligible assets.

• Scheduled Version Update tasks are now counted under Scheduled Others. Asset detail and global task navigation no longer show scheduled Version Update tasks only in the parent Scheduled Tasks count while all child categories show zero.

• The Task Info DRONE label now shows the correct state. Acquisition tasks that used a DRONE Analyzer Profile or legacy DRONE enablement no longer appear as DRONE disabled when analysis was actually enabled.

• Auto-update tasks now use the Responder lane declared in the same visit. AIR now builds automatic update tasks from the lane reported by the Responder during the current visit, reducing unnecessary Console fallback downloads when CDN packages are available.

• The Send to Case dropdown now stays open until the user acts. Row-level Send to Case menus open on click and remain available until the user clicks away or sends the assignment to a case.

• The Actual DB Usage page no longer fails with a missing organization error. Optional organization filters are now handled correctly, including empty or omitted values, so the page can load without making the AIR session feel unresponsive.

• Cancel buttons are visible in dark mode. Notification integration modals now use the correct button theme so Cancel actions remain readable in dark mode.

• Investigation Hub evidence tree no longer crashes in production builds. AIR now uses a tree-shake-safe aggregation path when building the evidence tree, preventing the affected view from failing after production build optimization.

• Case task APIs now return the correct interACT report URL. Public case task responses now point interACT assignments to the interACT report instead of the Investigation Hub dashboard.

• Investigation Hub import failures are now reported honestly to the queue layer. Permanent import errors now fail the job after the assignment status is written, reducing cases where partial imports appeared as successful at the job level.

• Task-completed notifications now match task outcomes more accurately. Notifications now include interrupted endpoint counts and classify partial outcomes consistently with task views.

• On-premise outbound CIDR behavior was corrected for private validation targets. When the outbound CIDR environment setting is empty on on-premise deployments, AIR again allows private validation targets while continuing to block loopback, link-local, unspecified, and cloud-metadata addresses.

• Recent activity creation is now scoped to the caller’s organizations. AIR no longer returns names or organization IDs for cases, tasks, assets, or reports outside the caller’s authorized scope through recent-activity creation.

• Login session cleanup is now scoped to the logging-in user. One user exceeding the session-history cap can no longer remove session-history records for other users.

• Relay and RelayPro registration now enforce tenant isolation. Relay registration now verifies that the asset belongs to the organization proven by the deployment token, and RelayPro lookups are scoped by organization.

• Git repository browse-tree cache keys are now scoped correctly. Cached repository trees are separated by organization, repository, host, and credential identity, preventing cross-tenant cache collisions and stale listings.

• Git repository webhook secrets are no longer returned to view-only callers. Read-only repository access no longer exposes the secret used to authenticate anonymous repository sync callbacks.

• interACT command-result downloads now reject path traversal filenames. Download requests must use plain filenames, preventing access outside the intended command-result directory.

• Processor proxy security checks now apply regardless of URL casing. Mixed-case processor proxy paths now pass through the same body parsing and outbound validation path as lowercase routes.

• Case note write permissions are aligned between API versions. Case note create, edit, delete, and task-assignment import actions now require case management permission consistently. Case owners, note writers, and global administrators can delete notes according to the corrected rule.

• All-organization shared resources have stronger mutation checks. Organization-scoped users can no longer delete or modify shared disk image acquisition profiles, interACT snippets, interACT tags, policies, or auto asset tagging rules through routes that previously missed the all-organization check.

• TAXII tag filtering now avoids oversized URLs. AIR can filter triage rules by tag prefix instead of expanding nested tag trees into hundreds of individual identifiers, preventing failures in environments with large rule-tag hierarchies.

• API documentation mobile navigation and sidebar spacing were improved. The documentation sidebar no longer overlaps key controls, and mobile navigation keeps the menu, title, and API controls usable on smaller screens.

What’s New?

• Asset status notifications improve response readiness. AIR can now notify teams when a Responder-backed asset becomes Unreachable or Unmanaged, based on preferences configured in Notification Settings. This helps analysts identify coverage gaps earlier and avoid starting response actions against assets that are no longer ready for investigation tasks.
• System Resources now highlights operational risk before it affects investigations. On-premise deployments now have a redesigned System Resources view with CPU, memory, and disk cards, plus an application-wide low-disk warning. This helps administrators detect capacity issues before evidence collection, analysis, or reporting workflows are impacted.

New Features & Improvements

Investigation Hub and Case Workflows

Improved Investigation Hub reliability during imports

Several Investigation Hub import paths have been strengthened to preserve evidence consistency during concurrent or retried imports. AIR now handles overlapping case and task-assignment imports more safely, isolates temporary evidence databases per import, and avoids shared-state races during DRONE result ingestion.

These improvements reduce the risk of missing findings, duplicated imported rows, inflated counters, or incomplete evidence visibility after interruptions. For analysts, this means Investigation Hub results are more dependable during large investigations or when the same task data is opened from more than one workflow.

DRONE findings and DRONE analysis imports now coordinate more safely when both write results for the same task assignment. AIR also recovers analysis rows that could previously be removed by a concurrent cleanup path, improving confidence that automated findings remain available after import completion.

Evidence Collection and Responder Operations

Default Memory Limit is now 4 GiB

The default Memory Limit for responder tasks is now 4 GiB. Previously, a missing memory configuration meant unlimited memory usage. The new default limits the resource exposure of task execution while preserving the option to set unlimited memory deliberately.

The 4 GiB default appears in task customization, policy configuration, and interACT shell task options. The Default Policy also converges to 4 GiB during upgrade, so new tasks that follow the Default Policy inherit the safer limit automatically.

Entering 0 or clearing the Memory Limit field still means unlimited. Existing custom policies keep their stored values, including explicit unlimited values. This allows administrators to keep intentionally configured exceptions while improving the default posture for the broader fleet.

Integration users should note that task callers that omit a memory value now receive the 4 GiB resolved default. To restore unlimited behavior for those callers, create a higher-priority custom policy with Memory Limit cleared or set to 0.

Linux Responder packages for older and newer kernels

AIR now ships two Linux Responder packages so both older and modern Linux assets stay supported:

• Legacy — for Linux kernel 2.6.32 and above. Use this on older distributions.
• Edge — for Linux kernel 3.2 and above. Use this on modern distributions.

These kernel ranges follow the Go runtime used to build each package. The Edge package is built with Go 1.26, which requires Linux kernel 3.2 or newer. The Legacy package keeps support for older kernels that cannot run that runtime.

When a Linux Responder is downloaded or deployed, the package that matches the asset’s kernel should be chosen. For assets already managed by AIR, later updates use the matching package automatically.

What happens to existing Linux assets: AIR does not yet know which package an already-installed Linux Responder should use. Those assets therefore receive the Legacy package on their first update after this change. After that update, AIR can match the asset’s kernel: hosts running kernel 3.2 or newer move to the Edge package on the next update. Older kernels stay on Legacy.

Responder User-Agent management through CDN records

AIR can now retrieve validated User-Agent records from the Responder CDN and deliver the appropriate value to responders through the existing configuration flow. This allows User-Agent values to be updated without requiring a responder release.

The Console periodically refreshes the record set, validates freshness and format, stores the accepted version locally, and recalculates configuration tags only for affected assets. This keeps responder configuration changes targeted and avoids unnecessary updates across unaffected platforms.

This improvement helps administrators respond faster when endpoint security controls require updated User-Agent strings for responder communication.

Default-secure deployment commands

Deployment commands now validate TLS certificates by default. For on-premise environments that use self-signed or private certificates, authenticated administrators can explicitly choose the insecure copy option where available, or pass the documented script flag manually.

This change improves the default security posture of responder deployment while preserving an operational escape hatch for controlled on-premise environments. SaaS and shareable deployment links do not offer the TLS bypass option.

Asset Visibility, Notifications, and Response

Asset status change notifications

AIR now generates notifications when responder-backed assets become Unreachable or Unmanaged, based on preferences configured in Notification Settings. Notifications can be delivered through in-app, email, Slack, Teams, and Mattermost channels according to the customer’s notification configuration.

These alerts help analysts and administrators detect asset availability or management changes before starting collection or response tasks. For example, if an asset becomes Unreachable, teams can address connectivity or responder readiness before relying on that asset for evidence collection.

Notifications are deduplicated by asset and state transition so repeated scans do not create excessive noise for the same condition.

System Resources visibility and low-disk warning

The System Resources page has been redesigned for on-premise deployments. It now presents CPU, memory, and disk utilization as cards with warning and critical states.

When the application and database use separate hosts, AIR can show separate disk cards for each. If disk usage becomes high, a warning bar appears at the top of the application and links directly to System Resources for review.

Administrators can snooze or dismiss the warning. If severity increases, AIR shows the warning again so teams do not miss a worsening storage condition. This is especially important for investigation environments where disk pressure can affect evidence ingestion, storage, and reporting.

interACT workflow improvements

interACT now handles asset selections more consistently across the Assets page, case assets, endpoint details, and the Quick Start wizard. When a selection starts from a filtered asset list, AIR hydrates the selected asset details so session tabs show the correct asset name, platform, and IP address.

When analysts use Select all items from the Assets page, interACT now resolves the matching eligible assets before starting sessions instead of closing the wizard without creating sessions. AIR also respects the session limit and remains on the wizard if no eligible asset remains.

The interACT All tab now clears command results and command history when all sessions are closed. This prevents stale output from appearing in a later, unrelated session set or being included in exported reports.

Administration, Access Control, and Integrations

Optional SMTP authentication

SMTP username and password fields are now optional. Customers that use internal SMTP relays or unauthenticated SMTP servers can configure email delivery without supplying credentials.

When credentials are configured, the UI clearly indicates whether a saved password exists. Administrators can keep the stored password, update it, or clear it explicitly. If the username is empty, AIR does not send SMTP authentication details.

Repository Explorer permission clarity

Repository Explorer access is now aligned with Evidence Repository view permission. Users who can view evidence repositories can browse and download through Repository Explorer without also requiring cloud asset account visibility.

Disk image import remains gated by the appropriate asset-creation permission and requires a resolved account context. This improves least-privilege access for teams that need to review repository content without managing cloud asset accounts.

Bug Fixes

• interACT sessions started from asset selections now show asset names correctly. Sessions opened from bulk selection, endpoint details, or case assets previously showed blank tabs, missing platform icons, empty IP values, and “Unknown Session” in command results. AIR now hydrates selected asset details before creating sessions.
• interACT Select all items now starts sessions instead of silently closing. When analysts selected all filtered assets and clicked Connect, no request was sent and no session was created. AIR now resolves the filter to eligible assets, respects exclusions and limits, and keeps the analyst in the wizard if nothing can be started.
• interACT All tab no longer carries results into a new session set. Command results and command history are cleared when the final session is closed, preventing stale output from appearing in a later session or in exported reports.
• interACT WebSocket authorization now enforces session ownership. The Console now verifies that the connecting user owns the requested interACT session and that the connection asset matches the session asset. This aligns WebSocket behavior with the REST session guard.
• Responder update actions now respect asset eligibility. AIR no longer enables Update Responder Version when all selected assets are excluded from updates, in maintenance mode, or already ineligible. Asset detail pages also no longer offer manual updates for assets manually excluded from updates.
• Stale version-update badges are cleared more reliably. Assets no longer continue to show Waiting or Scheduled after auto-update is disabled or when an update policy blocks the asset. Manual exclusion also clears stale lifecycle status.
• Linux responder updates now use the lane declared during the same poll. AIR no longer builds an automatic update task from stale lane data loaded before the current heartbeat or visit. This prevents assets from being offered the wrong Linux package on the first lane-aware update.
• Deploy Responder for cloud assets now targets only the selected asset. A selection containing one AWS cloud asset could previously trigger deployment for multiple devices. AIR now resolves expression filters correctly and intersects them with the selected asset list.
• Isolation task failures no longer leave assets stuck in Isolating or Unisolating. When an isolation task fails, AIR now reverts the asset state so analysts can retry or initiate the appropriate follow-up action.
• Repository Explorer browse now works for view-only evidence repository roles. Users with Evidence Repository view permission can browse repository content even if they do not have cloud asset account visibility. Import actions remain controlled by the required asset permissions.
• Cloud Sync Failed notifications are now readable. Notification bodies no longer display raw JSON or literal newline characters. AIR now renders a clean, single-line message in the header popover and notification history.
• On-premise Global Search no longer exposes the SaaS-only Update settings page. Deployment-model route metadata is now applied consistently, so SaaS-only settings do not appear in on-premise search results or direct navigation paths.
• Investigation Hub DRONE imports no longer race on shared temporary database files. Each DRONE import now uses an isolated temporary path, preventing concurrent imports of the same task assignment from corrupting or deleting each other’s input.
• Investigation Hub Case.db ingest is safe under concurrent case and task-assignment imports. AIR now avoids shared SQLite data-source state that could delete another in-progress import’s database and produce empty or missing evidence tables.
• DRONE import cleanup now releases temporary files and archive handles on all paths. Malformed or incomplete archives no longer leave open handles or temporary files behind, reducing the risk of storage and file-handle exhaustion during repeated retries.
• DRONE findings and DRONE analysis imports no longer delete each other’s rows. AIR now serializes the overlapping write paths and co-enqueues recovery when needed, reducing the risk of silent finding loss after retries or concurrent imports.
• External evidence import retries no longer duplicate rows or counters. Retried imports now clean up prior rows for the same import before re-inserting and recompute counters from stored data instead of incrementing stale values.
• Tornado evidence import retries are now idempotent. AIR now creates the assignment before marking the import completed or deleting upload records, preventing unrecoverable retries and duplicate imported evidence.
• Investigation Hub migration-wait retries no longer create duplicate delayed import jobs. AIR now delays the current job instead of adding new jobs with random identifiers while a migration is active.
• Refactored osquery ingestion now builds valid evidence queries. Triage and acquisition assignments containing osquery results no longer fail with SQL syntax errors when the refactored ingestion path is enabled.
• Malformed PST and imported-data feeds now return controlled validation errors. Empty, truncated, or wrong-format inputs no longer fall through to generic internal errors in the evidence import pipeline.
• Imported-evidence task assignment lookup now uses parameterized values. AIR fixed a blind SQL injection path in the Investigation Hub imported-evidence lookup. Unmatched import IDs now return a controlled not-found response instead of an internal error.
• Fleet-action filters now honor legacy includedIds and excludedIds fields. Requests that explicitly target a non-existent asset ID now fail closed instead of widening to every managed asset in the organization.
• Evidence repository validation now requires repository management privileges. View-only users can no longer use validation routes as outbound connection tests. This better aligns connection validation with repository create and update permissions.
• On-premise outbound validation now blocks private network ranges by default. Repository and related outbound connection tests now reject RFC1918 private destinations unless administrators explicitly allow the required internal ranges. Customers using private evidence repositories should configure the allowed outbound CIDR ranges before validating those repositories.
• Cross-organization Git repository browsing has been blocked. AIR now applies organization-scope checks when browsing repository trees or listing branches from stored repository connections.
• SSO provider management now requires Global Admin authority. Users with settings-save privileges but without Global Admin authority can no longer create or modify SSO providers. This protects the trust boundary around identity provider configuration.
• Organization admins can no longer reset Global Admin 2FA. AIR now applies the same target-tier protection to reset 2FA that already existed on neighboring user-management actions.
• Stored XSS paths were closed across several user-controlled fields. AIR now validates or escapes case names, endpoint hostnames, Full Text Search profile keywords, and Slack channel names before they can execute in notification panels, profile editors, or routing dialogs.
• OpenAPI documents are no longer anonymously exposed. Swagger JSON and YAML documents are now served through authenticated API paths, and legacy public paths redirect to the protected routes.
• Cloud account sync and GCP-related notification rendering was improved. Cloud Sync Failed messages now display in a user-readable format and no longer expose raw object payloads in the notification UI.
• Quick Start image evidence privilege tests and related UI behavior were stabilized. The UI now asserts the correct access contract by disabling the parent action rather than relying on hidden nested menu content.

What’s New?

• Multi-channel operational notifications help teams respond faster. AIR now supports notification delivery through email, Slack, Microsoft Teams, and Mattermost in addition to in-app notifications. Analysts and administrators can route important task, case, asset, system, and Investigation Hub events to the channels where response teams already work, reducing the chance that critical updates are missed during an active investigation.
• Advanced expression-based filtering improves asset targeting. Analysts can now build nested asset filters with AND/OR logic, text matching, date and number comparisons, tag conditions, regular expressions, blank/not blank checks, and CSV-imported values. The same filter logic applies across lists, counts, exports, presets, task assignment, and bulk actions, helping investigation teams target exactly the right asset set with more confidence.
• Box is now available as an evidence repository destination. AIR can save collected evidence to Box repositories using supported Box authentication methods. This gives teams another managed destination for investigation evidence while preserving the existing repository selection experience in acquisition workflows.
• AI application artifact collection is now available. Acquisition profiles now include AI application artifact sources across Windows, Linux, and macOS. A new predefined AI Evidence Collection profile helps analysts collect relevant local AI tooling artifacts without building custom profiles from scratch.
• Responder update visibility gives administrators clear update status across the fleet. AIR now records and displays Responder update state, update history, retry status, exclusion status, and the reason an asset is waiting, skipped, or failed. This helps administrators understand update posture without relying on temporary logs or repeated manual checks.
• Asset Tag Catalog enables tag governance before assets are assigned. Administrators can now create, rename, delete, and manage asset tags independently from asset assignment. Auto Asset Tag rules also create their catalog tags when saved, so defined tags are visible immediately even before a rule matches an asset.
• Breaking change for API users. Asset-filter bulk API call now includes an assertions guard: an upper bound on how many assets may be affected. Now assertions is required on filter-based bulk endpoints, which was previously optional. Integrations should be updated accordingly, with setting a threshold that matches safety limits. Details can be found on http://docs.binalyze.com.

New Features & Improvements

Notifications and Automation

Breaking change for API users

To improve operational safety for API-driven bulk actions, filter-based asset endpoints now require an assertions guard that sets the maximum number of assets a request may affect.

API consumers must include { “assertions”: { “failIfNumberOfAssetsGreaterThan”: NUMBER } } in requests to supported bulk endpoints; if the filter matches more assets than the specified threshold, the request will fail without executing.

This protection applies across operations such as acquisition, triage, full-text search, auto asset tagging, baselining, reboot/shutdown/isolation, log retrieval, version updates, and uninstall/purge actions. This is a breaking change for API integrations; UI workflows are unaffected.

Customers and partners should update their integrations, choose thresholds appropriate to their operational safety limits, and validate changes in a non-production environment before rollout. See the KB article for the full list of affected endpoints and http://docs.binalyze.com for payload details.

Multi-Channel Notification System

AIR now supports a broader notification model across in-app notifications, email, Slack, Microsoft Teams, and Mattermost. This allows cybersecurity teams to receive operational updates in the communication tools they already monitor, including task status changes, case activity, asset events, Investigation Hub activity, and system notifications.

Users can manage their personal channel preferences from Account > Notification Settings. Notification types are grouped by category, and users can choose whether each type is delivered in-app, by email, or only when the event is related to them. Email notifications include structured event details and links back to AIR.

Administrators can configure Slack, Microsoft Teams, and Mattermost destinations from Settings. Slack supports both workspace-based channels and incoming webhooks, while Teams and Mattermost use webhook-based delivery. Each destination can be enabled, disabled, tested, and routed to selected notification types.

API Token Expiration Notifications

AIR now notifies API token owners when a token is close to expiration. The notification includes the token name, description, creation date, last-used date, and expiration date without exposing the token value.

This helps administrators and API users rotate credentials before integrations fail, reducing service interruption risk for automated workflows and external tooling.

Asset Management and Filtering

Advanced Expression-Based Filtering for Assets

AIR now supports recursive expression-based filtering for assets, disk images, and case assets. Analysts can combine nested AND/OR groups and field-specific operators to build precise filters across names, types, status fields, dates, tags, metadata, cloud attributes, and other asset properties.

The Advanced Filter experience includes live result counts, CSV import of up to 10,000 values, saved preset support, and consistent behavior across asset lists, exports, statistics, task targeting, and bulk actions. This helps analysts move from investigation hypotheses to targeted action without writing scripts or manually translating filters between product areas.

Explicit selections and exclusions are represented as filter expressions, so select-all workflows and deselected assets retain a clear target definition.

CSV-Based Asset Targeting

Expression filtering supports CSV-imported values for asset identifiers and other supported fields. This is useful when investigation teams receive a list of hostnames, asset names, or other indicators from another tool and need to apply AIR actions to that exact subset.

Analysts can import the values into Advanced Filter, review the matching count, and then use the resulting filtered set for exports, tagging, evidence collection, Hunt/Triage, or other bulk actions.

Asset Tag Catalog

AIR now includes an Asset Tag Catalog under Library. Administrators can create, rename, delete, search, and manage organization-scoped asset tags without first assigning them to an asset.

This supports tag governance and investigation readiness. Teams can predefine tags such as investigation status, containment state, critical server role, or business ownership before responders are deployed or before assets are available in AIR.

The Assets sidebar now supports inline tag creation and rename workflows. Asset tag counts can deep-link back into the Assets view, helping analysts quickly focus on assets assigned to a specific tag.

Auto Asset Tag Rule Tag Creation

When an Auto Asset Tag rule is saved, AIR now creates or updates the related tag in the catalog immediately. The tag no longer remains invisible until the first asset matches the rule.

This makes rule configuration easier to validate. Administrators can confirm that a newly defined tag exists, use it in filters, and maintain a consistent taxonomy even before the rule has matched any assets.

Responder Auto Update Visibility

AIR now persists Responder update lifecycle information for each asset. The Assets list includes version status, and the asset detail page shows update status, update reason, and update history for automatic, manual, and retry attempts.

Administrators can understand why an asset is waiting, scheduled, excluded, failed, retrying, or blocked by maintenance or running work. This reduces uncertainty during fleet updates and gives Support and operations teams a shared view of update state.

Responder Update Policies now include clearer default-policy wording, a count of manually excluded assets, and a searchable modal for reviewing those assets. Administrators can select excluded assets and include them back into update policies directly from the modal.

The excluded-assets view also shows which update policy would apply after inclusion. This helps administrators understand the effect of re-enabling updates before making the change.

Evidence Collection and Repository Integrations

Box Evidence Repository

AIR now supports Box as an evidence repository provider. Administrators can create Box repositories from the Evidence Repositories settings area and configure supported authentication methods, destination folder ID, and optional subfolder paths.

Box repositories can be selected in supported evidence collection workflows where upload behavior is compatible with Box. AIR validates Box connectivity and encrypts stored Box credentials.

Because Box uploads require the total file size up front, AIR clearly disables unsupported streaming scenarios such as direct collection and interACT transfers for Box. The UI includes guidance explaining these limitations so administrators can choose the correct repository type for the collection workflow.

AI Evidence Collection Profile and Collectors

AIR now exposes AI application artifact sources in acquisition profiles for Windows, Linux, and macOS. These sources are available through the acquisition profile evidence selection experience and can be included in custom profiles.

A new predefined AI Evidence Collection profile includes the available AI artifact sources across supported operating systems. This gives analysts a faster path to collect local AI tooling artifacts during investigations where AI application usage may be relevant.

The existing Full and Compromise Assessment predefined profiles continue to include the relevant artifact sources.

Improved Disk Image and Evidence Acquisition Workflows

Quick Start acquisition flows received additional safeguards and consistency improvements. Large asset selections now display typed confirmation before assignment in supported Quick Start workflows, reducing the risk of starting broad tasks unintentionally.

Quick Start Acquire Evidence, Acquire Image, Image Evidence Acquisition, Full Text Search, Triage, Auto Asset Tagging, Update Responder, and Comparison workflows now use more consistent selection, validation, scheduling, case selection, and repository confirmation behavior. This helps analysts follow the same task setup pattern across collection and analysis workflows.

Investigation Hub and Analysis Workflows

Investigation Import Reliability

Investigation Hub import handling is now more resilient when imports are retried, restarted, or reprocessed. AIR now cleans up assignment-specific imported data based on database state rather than relying on retry counters, reducing the risk of duplicated evidence rows after interrupted imports.

Drone findings import cleanup now covers the drone-owned evidence tables and related metadata written by the import, not only the findings table. Parent import retry behavior was also adjusted so active child imports are not wiped by a retry of the parent job.

These changes help preserve investigation data consistency and reduce the chance that repeated imports create inflated row counts or misleading import statuses.

Threat Intelligence and External Integrations

TAXII Feed Duplicate Action and Indicator Labels Filter

TAXII Feeds now include a Duplicate action. Administrators can start a new feed configuration from an existing feed, including the values that can be safely prefilled, and then edit the configuration before saving.

TAXII indicators now support filtering by labels. This helps analysts focus on indicators associated with selected STIX labels and makes it easier to explore intelligence feeds by category or source context.

Outpost is Accessible in AIR

AIR now includes Outpost feature. When enabled, administrators can access the Outpost entry point and related product information from the AIR interface.

This provides a clearer path for customers evaluating or adopting Outpost capabilities alongside AIR investigation and response workflows.

Bug Fixes

• Restricted off-network package downloads to authorized users. AIR now requires assignment privilege and package ownership before serving off-network responder packages through private or public download routes. This prevents organization-scoped users from downloading another organization’s package and accessing repository connection details embedded in that package. Signed share links remain unchanged and still require a valid server-issued signature.
• Hardened organization isolation across public APIs, WebSockets, scheduled tasks, and configuration paths. AIR now applies missing organization ownership checks to task cancellation by filter, public scheduled Hunt/Triage updates, scheduled Auto Asset Tagging updates, public Auto Asset Tag rule deletion, evidence repository validation by ID, Investigation Hub WebSocket connections, and interACT WebSocket connections. These fixes align WebSocket and public API behavior with the guarded REST routes and prevent cross-organization access to live investigation activity, task control, repository validation, and response sessions.
• Blocked privilege escalation through role and organization assignment. AIR now prevents organization-scoped administrators from granting all-organization access unless they already have that scope. Role assignment now verifies that the caller is authorized to grant the privileges contained in the selected role, preventing a low-privilege user manager from assigning a higher-privileged role to themselves or another user.
• Strengthened Investigation Hub SQL query protections. The v2 SQL query endpoint now applies stricter read-only safeguards, function and cast allowlists, scope anchoring, and safer error handling. This prevents queries from escaping the selected investigation scope, reaching restricted database metadata, or using unsafe object-reference and XML helper paths.
• Closed SQL injection paths in asset sorting and Investigation Hub global search. AIR now validates sortable fields and evidence table identifiers before building queries. This prevents crafted sort or evidence category values from influencing database query structure while preserving supported sorting and search behavior.
• Fixed AI Assistant output rendering. Model-generated HTML is now rendered as inert text instead of live DOM content. This prevents script execution from AI-generated responses while preserving markdown and code display behavior for investigation assistance.
• Replaced cleartext temporary passwords with reset links. Admin-initiated password reset now returns a time-limited reset URL instead of a temporary password. The user’s current credential is invalidated, the reset token is single-use, and the UI shows a copyable reset link with expiry information.
• Improved cookie security attributes. AIR now sets secure cookie attributes for applicable UI and analytics cookies when served over HTTPS, while preserving compatibility for HTTP-based installations.
• Made license capacity enforcement atomic during Responder registration. AIR now serializes slot-consuming registration paths so concurrent registration waves cannot exceed the licensed asset capacity. Existing managed asset re-registrations use a fast path and do not consume additional license slots.
• Reduced notification query load on large notification tables. Notification count behavior was improved so large notification backlogs do not cause repeated heavy database work for the header badge and notification list. This improves Console reliability during high-volume asset registration or operational event bursts.
• Fixed SSL restoration after backup restore. On-premises deployments now re-run SSL bootstrap on every application boot and retry if startup dependencies are not ready. This allows restored SSL settings to re-materialize the web configuration files and prevents the web container from staying unhealthy after single-tier to two-tier migration restores.
• Fixed disk image and cloud asset detail ID confusion. Detail views now validate that route parameters are real asset IDs before calling asset-scoped APIs. This prevents misleading “Asset not found” errors and unnecessary 404 responses when navigation paths carry task IDs or other identifiers.
• Fixed case task import retry from the Import Status column. Case task tabs now retry failed imports against the case investigation rather than an assignment-level or missing investigation ID. The retry action now sends the correct request and no longer shows a forbidden error for authorized users.
• Fixed Investigation Hub evidence reload banner placement. The “New evidence has been added to the investigation” banner now remains at the top of the page and no longer appears in the center of the screen or blocks import controls.
• Improved Investigation Hub import idempotency. Re-importing or retrying the same task assignment no longer duplicates imported evidence rows. Drone findings cleanup now includes related drone-owned evidence tables and metadata, and parent retry behavior no longer wipes active child import work.
• Restored task execution log ingestion in the refactored Investigation Hub ingestion pipeline. Task execution logs are now populated through the refactored ingestion path, so the Task Execution Logs tree appears when the collected data contains task logs.
• Fixed Responder update actions for manually excluded assets. AIR no longer offers manual Responder update actions for assets excluded from updates. Bulk update actions and asset detail update cards now use the same eligibility rules as the backend assignment filter, preventing zero-assignment tasks and misleading success messages.
• Restored large-task confirmation for select-all assignment flows. Select-all actions that target large asset sets now display the confirmation dialog based on assignable count, even when the assignable count is a small percentage of the full organization asset count.
• Fixed RelayPro manual deployment package naming. The RelayPro Linux deployment instructions and downloaded package naming now align so the provided installation command works without manual filename edits.
• Fixed Acquisition Profile dropdown mouse-wheel scrolling. The acquisition profile dropdown now supports mouse-wheel scrolling inside slide panels, improving profile selection when many profiles are available.
• Improved Google Cloud Storage validation messages. Billing-disabled and permission-related validation failures now return clearer messages instead of misleading users with an “Invalid Project ID” error when the project ID is correct.
• Sanitized evidence repository validation errors. AIR no longer returns raw backend error details, internal paths, request configuration, or low-level network codes in evidence repository validation responses. Azure and S3-compatible validation failures now return safer user-facing messages while preserving detailed diagnostics in server logs.
• Fixed long-expired license UI gating. The UI now remains locked when a license is expired even after the remaining-days value becomes negative. This keeps the Console state aligned with backend license decisions.
• Improved GCP account and repository behavior. Heavy Google Cloud clients now load only when a GCP workflow is actually used, reducing memory usage for tenants without GCP activity. GCP validation errors are also mapped more accurately.
• Fixed GCP account creation metadata failure paths. GCP account creation and validation flows were updated so plugin metadata retrieval and related SDK usage behave reliably during account setup.
• Fixed backup, disk usage, evidence repository, user management, deploy, and off-network UI reliability issues found during integration coverage work. These areas received improved route guarding, loading and error handling, state reset behavior, and consistent navigation while keeping existing customer-facing URLs unchanged.
• Fixed Quick Start Update Responder conflict preflight ordering. Immediate Responder update tasks now always run validation, broad-task confirmation, conflict preflight, and assignment in the correct order, preventing conflict checks from being skipped after large-selection confirmation.
• Fixed Quick Start Image Evidence Acquisition large-selection confirmation. The disk image evidence acquisition wizard now shows the large-selection confirmation dialog before broad assignments, matching other Quick Start task flows.
• Fixed task import status display and retry state in case task tabs. Failed import rows now read the correct import status field and show Retry when appropriate, including assignments that have not yet populated investigation metadata.
• Fixed UI messaging and rendering around Box repository limitations. Box setup and disabled-state notices now use clearer copy and better multi-line alert layout, helping administrators understand upload-only behavior and folder selection risks.
• Fixed Auto Asset Tagging and Responder Update Policy UI consistency issues. Auto Asset Tag and Responder Update Policy views now better reflect selected assets, excluded assets, policy matches, and available actions.
• Fixed Investigation Report oversized logo validation. Oversized company logos are now rejected consistently during validation instead of sometimes falling through to an internal error.
• Improved service and container hardening. Runtime container images and bundled services were updated or adjusted to remove outdated operating system components and resolve reported security findings without changing product workflows.

What’s New?

• Cyber Threat Intelligence (STIX/TAXII Feed) Integration for operationalized threat intelligence: AIR can now connect to TAXII 2.x threat intelligence sources, pull STIX indicators, parse supported indicator types, and convert them into YARA, Sigma, and osquery Hunt/Triage rules. This helps analysts bring external threat intelligence directly into investigations without manually exporting, converting, and uploading indicators.
• Responder update policies: Administrators can manage automatic Responder updates through policy groups and filters, including policy scheduling, asset match counts, and per-asset update status visibility. This helps teams keep Responders current while controlling update rollout for sensitive or operationally constrained assets.
• Disk I/O Priority for tasks and policies: AIR now supports a Disk I/O Priority resource limit for policy and task configurations. Analysts can tune collection and response activity to reduce performance impact on critical assets during active investigations.
• Safer Active Directory disable flow: Disabling Active Directory integration now includes clearer impact information and an explicit keep-or-remove decision for AD-synced assets. This reduces the risk of unintended Responder uninstall activity and gives administrators better control during directory integration changes.
• Expanded Windows SMB event coverage in acquisition profiles: Full, Quick, and Compromise Assessment profiles now include additional SMB-related Windows event records. This gives investigation teams stronger visibility into file-sharing, authentication, and SMB-related activity during evidence collection.
• PostgreSQL 18 support for on-prem deployments: AIR now supports PostgreSQL 18 for on-prem environments with version 5.23. After upgrading AIR, administrators can schedule the PostgreSQL upgrade separately during a planned maintenance window, helping ensure continued compatibility, performance, scalability, and support for future AIR releases.
• Dual Go runtime support for Windows Responders: AIR now automatically delivers a Go 1.26-based Responder to Windows 10 and later devices, while earlier Windows versions continue to receive the Go 1.20 build. Both variants provide the same functionality, improving security scanner compliance without affecting legacy OS support or requiring configuration changes.

New Features & Improvements

Threat Intelligence and Hunt/Triage

Cyber Threat Intelligence (STIX/TAXII Feed) Integration

AIR now supports TAXII Feed Integration for connecting to TAXII 2.x compliant threat intelligence servers. Teams can configure a feed with a server URL, authentication method, collections, sync interval, and conversion preferences. AIR then pulls STIX indicators and converts supported indicators into investigation-ready Hunt/Triage content.

The feature supports public and authenticated feeds, collection discovery, manual and scheduled sync, sync logs, indicator browsing, confidence thresholds, and managed or snapshot ownership modes. Managed feeds regenerate system-owned rules as indicators change, while snapshot feeds allow analysts to capture a point-in-time set of indicators without modifying or deleting previously generated rules.

For analysts, this reduces the time between receiving intelligence and using it in an investigation. File hashes, domains, URLs, registry keys, mutexes, process names, direct YARA, and direct Sigma indicators can be transformed into YARA, Sigma, and osquery rules according to the selected conversion configuration.

To use the feature, open the Integrations area, create a TAXII feed, test the connection, select collections, choose the rule generation settings, and save the feed. After sync, generated Hunt/Triage rules become available for investigation workflows according to the configured ownership mode and rule settings.

Expanded SMB Event Log Coverage

Windows acquisition profiles now include expanded SMB event coverage. Full, Quick, and Compromise Assessment profiles have been updated with SMB client, SMB server, and Security channel event selections that preserve higher-value SMB investigation signals while limiting noise in faster profiles.

This improvement helps analysts review file-sharing, share modification, authentication, and SMB security activity during post-incident investigations. It is especially useful when investigating lateral movement, remote access to shared resources, and suspicious file access patterns.

The Full profile includes the broadest researched event coverage, Quick includes a security-focused subset, and Compromise Assessment includes the strongest low-noise indicators. Existing event selections remain unchanged.

Investigation Hub and Case Workflows

Case Task Import Status Visibility

Case task listings now reflect Investigation Hub import status more accurately. When task data is imported into Investigation Hub, AIR mirrors the status into the task assignment metadata used by case task grids.

This gives analysts clearer visibility into whether task results have been imported and are available for review in Investigation Hub, reducing confusion when evidence appears in Investigation Hub but the case task list previously showed the import status as not applicable.

Assets, Responders, and Task Execution

Responder Update Policies

AIR now provides grouped Responder update policies in Settings. Administrators can configure automatic update behavior through policy cards, filters, schedules, matching asset counts, and a unified save workflow.

The asset detail view now shows resolved Responder update status, helping operators understand whether an asset receives automatic updates, which policy applies, and what action may be needed. This improves update governance across large environments where different asset groups require different rollout behavior.

A typical use case is to define a policy for a tagged or filtered group of production servers, apply a specific update window, and review matched assets before saving. New assets that match the policy criteria can then inherit the intended update behavior without a manual bulk operation.

Disk I/O Priority for Task Resource Control

Task and policy configuration now includes Disk I/O Priority. The priority can be set from Lowest to Highest, with Medium as the default. AIR passes the selected priority to the Responder for supported task types.

This gives analysts and administrators more control over the runtime impact of investigation tasks. During active response, teams can lower priority for business-critical systems or increase priority when rapid evidence collection is more important than background resource usage.

The setting is available in task advanced options, policy resource limits, and interACT shell task options. Existing configurations that do not include the field continue to rely on Responder defaults.

Dual Go Runtime Support for Windows Responders

To improve security scanner compliance while maintaining compatibility with older Windows operating systems, AIR now delivers Windows Responders with the appropriate Go runtime based on the target OS version.

Starting with Responder 3.0.0, Windows 10 and later devices receive a Responder built with Go 1.26, while earlier Windows versions continue to receive a Go 1.20 build. Both variants provide the same Responder package, functionality, and feature set—the only difference is the embedded Go runtime.

This enhancement addresses vulnerability scanner findings related to older Go runtime versions (such as VOC-2709) without requiring customers to choose between modern security compliance and legacy operating system support.

Responder selection is performed automatically by AIR:

Windows 10 and later: Latest Responder (Go 1.26)
Earlier than Windows 10: Legacy Responder (Go 1.20)

No additional configuration or deployment changes are required. Both Latest and Legacy Responders continue to be fully supported.

As part of this change, the Windows MSI installer size increases from approximately 58 MB to 106 MB due to the inclusion of the newer Go runtime. Linux and macOS support for dual runtime delivery will be introduced in a future release.

Administration and Platform Operations

PostgreSQL 18 Support is Now Available for On-prem Deployments

After upgrading AIR to v5.23, administrators can upgrade PostgreSQL separately at a time that fits their maintenance schedule by following the PostgreSQL Upgrade Guide. The database upgrade is not performed automatically and requires planned downtime, during which AIR will be temporarily unavailable.

PostgreSQL 18 will become AIR’s supported database configuration at the end of August, so on-prem customers are strongly encouraged to plan their upgrade accordingly.

Before you begin, we recommend that you:

• Wait at least 24 hours after upgrading AIR.
• Close inactive cases.
• Create an AIR Backup.
• Review the PostgreSQL Upgrade Guide.

Safer Active Directory Disable Flow

Disabling Active Directory integration now provides a safer and more explicit flow. AIR shows an impact summary, including total affected assets and how many have Responders installed, before the operator chooses whether to keep or remove AD-synced assets.

This reduces the operational risk of disabling directory synchronization. Administrators can stop synchronization without unintentionally removing managed assets or uninstalling Responders, and can make a deliberate choice when cleanup is required.

Setup Wizard Proxy and Trusted CA Validation

The setup wizard now supports proxy validation before installation. Proxy and trusted CA checks use the same connectivity validation approach as the post-install Settings experience, helping administrators verify outbound connectivity earlier in the deployment process.

This improvement helps reduce setup friction in restricted environments. Administrators can validate proxy settings during installation and correct connectivity issues before completing the AIR deployment.

Backup History Encryption Column

The Backup History table now includes an Encryption column. The column shows whether each backup was encrypted, using the existing backup data already displayed in Backup Details.

Security, Governance, and Authorization Improvements

Git Repository Organization Scope Enforcement

Git Repository API endpoints now enforce organization scope more consistently. Users and API tokens with Git Repository privileges can only access repositories associated with organizations they are authorized to use.

This strengthens governance for customers using Git repositories to import or synchronize investigation content. Filtering, retrieving, creating, updating, deleting, syncing, and viewing logs now apply stricter organization relevance checks.

Privilege Dependency Validation

AIR now validates privilege dependency definitions more strictly. Every catalog privilege must have an explicit dependency entry, even when it has no dependencies.

This helps administrators configure roles more consistently. When a privilege requires a related view or supporting privilege, role configuration can auto-select or validate the required dependency instead of leaving users with incomplete access that causes screens or actions to fail.

Bug Fixes

• Expired task assignments now finalize parent task status. When assignments expired after remaining in Assigned or Processing for an extended period, parent tasks could stay stuck in Assigned or Processing even though no active assignments remained. AIR now treats expired assignments as settled for task completion accounting, recalculates the parent task, and includes a self-heal sweep for historical stuck tasks. This helps administrators and SOC teams identify whether investigation work is actually active.
• Retry Upload now preserves custom evidence repository folder naming. Retried uploads no longer land at the root of the evidence repository when custom evidence collection naming is configured. AIR now uses the original acquisition context so retried evidence follows the expected folder hierarchy.
• Evidence repository validation delay reduced in acquisition workflows. Selecting an unreachable repository in the acquisition customization step now times out faster and shows the existing inaccessible-repository warning instead of pausing for about 10 seconds or advancing without feedback.
• Global Search and Grid Search consistency improved. Grid search behavior has been corrected so users are less likely to miss records that are returned by Global Search for the same keyword.
• Case task import status now reflects imported Investigation Hub data. Case task pages no longer show imported task data as not applicable when the data is available in Investigation Hub.
• Asset resource usage no longer shows misleading zero-based values while metrics are pending. Newly registered assets now show a pending usage state until CPU, memory, and disk metrics arrive, instead of displaying values such as 100% CPU free or 0 B memory free.
• Production UI blank page after build upgrade fixed. A loading issue that could cause the AIR Console UI to display a blank page in production and staging builds has been resolved.
• All export functions now work behind proxied environments. Export preflight handling now uses a standard success response instead of a non-standard status code that could be rewritten by edge infrastructure. The UI now starts downloads on standard successful preflight responses and shows an error when export preflight fails.
• GCP account creation and verification now work with proxy and trusted CA configurations. AIR corrected the GCP client transport behavior that could fail with plugin metadata or response parsing errors during account creation.
• Azure remote command errors now show the real service message. Azure VM command failures no longer surface JSON parsing errors when the cloud service returns a plain-text error. Operators now see the actionable Azure error message, such as when a VM must be running before a command can execute.
• Full Text Search task flow now validates mandatory case selection consistently. AIR now shows the required case warning when progressing through the Full Text Search task flow without selecting a case, matching the Start action behavior.
• Responder update default schedule drawer now respects disabled time frames. The Default policy schedule drawer no longer shows “Set Time Frame” enabled when the backend explicitly has the time frame disabled.
• Forward proxy handling for internal processor traffic corrected. When a forward proxy is enabled, trusted Console-to-processor traffic for internal infrastructure now bypasses the proxy for private network targets. This prevents processors from appearing offline and disk image actions from being disabled when the proxy cannot resolve internal processor hostnames.
• Push-type task assignments now fail correctly when processor delivery fails. Disk image and DRONE-related assignments no longer remain in Assigned indefinitely after all processor assignment retries fail. AIR now marks affected assignments as Failed and rolls up the parent task status.
• Processor-side cleanup during asset deletion now reaches trusted internal processors. Asset deletion cleanup calls now use the trusted private-network path, preventing orphaned processor-side files when internal processor hosts were blocked by outbound safeguards.
• PST evidence import no longer blocks the main application event loop. PST import now runs asynchronously with streaming and bounded processing. This prevents long event-loop stalls, Redis connection storms, and health check failures in shared SaaS environments while still surfacing import failures to the UI.
• Worker processes now initialize white-labeling configuration. Task delivery failures caused by missing white-labeling configuration in worker processes have been resolved.
• Asset and case association lists now handle empty scopes correctly. Asset or Responder case tabs no longer show all organization cases when the asset has no related case assignments. AIR now returns an empty list when the related case scope is explicitly empty.
• interACT command-result downloads now require read permission. AIR now enforces the appropriate interACT read privilege before users can download persisted command output files. Enumerate-only users can no longer reach command-output resolution paths.
• Git Repository organization access tightened. Git Repository operations now reject access to repositories or organization scopes outside the caller’s assigned organizations.
• Gaps in case, task, and assignment counts were reduced for large environments. Task visibility queries and count retrieval were optimized to reduce expensive repeated list and count calls, especially for scheduled task views in large tenants.

What’s New?

• Retry failed task assignments without recreating tasks. Analysts can now retry eligible failed task assignments from task and asset workflows. This helps investigation teams re-run failed collection or analysis work on affected assets without rebuilding the original task, preserving operational context and reducing response time.

• Responder update workflows are easier to manage at scale. Responder update tasks can now be named and opened directly from tag action menus. This improves staged rollout tracking across large asset groups and helps administrators target updates more confidently.

• Advanced auto asset tagging conditions are available. Auto asset tagging rules now support additional negative and pattern-based operators such as “does not contain,” “does not start with,” and regex-style matching. This helps security teams classify assets more accurately in complex environments.

• Linux file system enumeration can be configured to include or exclude network-mounted file systems. Acquisition workflows now include an optional setting to include or exclude mounted network file systems when collecting Linux file system enumeration data. This gives analysts broader visibility when relevant artifacts may exist on mounted storage while keeping the default behavior conservative.

New Features & Improvements

Investigation Hub

Clearer Search Results and Failure Visibility

Investigation Hub now distinguishes between a successful search that returns no results and a search that could not complete because of a backend error, timeout, connection issue, or permission problem. Evidence grids now display an error row when data loading fails instead of showing an empty “No Records Found” state.

Global search also tracks success, partial success, and failure states. If some evidence categories fail while others succeed, analysts can still review partial results and see that the search did not fully complete.

Improved Large Evidence Detail Rendering

Evidence detail panels now handle very large array fields more efficiently. AIR deduplicates repeated values, shows occurrence counts, and paginates large lists instead of rendering every item at once.

This improves responsiveness when reviewing evidence items with thousands of values, such as matched strings or large parsed fields. Analysts can still copy, filter, and open values in relevant tools while avoiding browser freezes during evidence review.

Evidence Detail Label Localization

Network-related fields in the Investigation Hub’s Evidence Details view now display properly formatted labels — such as “IPv6 Address,” “IP Address,” “DHCP Enabled,” and “DHCP Server” — instead of auto-generated casing. The system resolves labels through translations first and falls back to generated labels only when no translation exists, improving readability for analysts reviewing network adapter data during investigations.

This improves readability in evidence detail views and helps analysts interpret network adapter data more quickly during asset and network-focused investigations.

Asset and Responder Operations

Retry Failed Task Assignments

AIR now supports retrying eligible failed task assignments without creating a new task. Users can retry a single failed assignment, retry all failed assignments from a task detail view, or retry eligible failures from bulk selections.

Retry applies only to failed assignments that are safe to re-run. AIR filters out ineligible items and provides confirmation before the retry starts. After a retry is triggered, the assignment returns to active processing and follows the normal task lifecycle.

This improves response efficiency when collection or analysis fails because of a temporary condition. Analysts can recover failed work while keeping the original task context and history.

Custom Names for Responder Update Tasks

Responder update tasks can now use a custom task name. If the user leaves the task name empty, AIR continues to generate a default name automatically.

This is useful for staged rollout plans where administrators update different asset groups over time. Meaningful task names make it easier to distinguish rollout phases, review progress, and communicate update status to operations teams.

Update Responder from Asset Tags

The tag action menu now includes an Update Responder option. When selected, AIR opens the responder update workflow pre-filtered to assets with the selected tag.

This supports customers who use tags to manage responder update waves. Administrators can target tagged asset groups directly without manually rebuilding filters in the Assets view.

CPU Core Limit Controls in Task and Policy UI

CPU Core Limit settings are now visible in policy limitations, task advanced options, and interACT shell task resource limits where supported by the Responder. The setting works alongside existing CPU percentage controls.

This gives administrators more control over how resource-intensive tasks behave on critical assets.

Evidence Collection and Acquisition

Optional Linux Network-Mounted File System Enumeration

Acquisition workflows now include an optional File System Enumeration Configuration setting for Linux. When enabled, AIR includes mounted network file systems such as network shares during Linux file system enumeration.

The setting appears when the selected acquisition profile includes Linux file system enumeration. It remains disabled by default to avoid unexpected collection from mounted network locations.

This gives analysts control when relevant artifacts may reside on mounted storage, while preserving predictable default acquisition behavior for standard investigations.

Improved Disk Image Parse Evidence Flow

The disk image File Explorer “Parse evidence” flow now preserves selected paths and related context when opening Quick Start. AIR also adjusts date and size defaults for path-scoped runs so explicitly selected files are not excluded by broad profile defaults.

This improves analyst workflows when parsing evidence from selected disk image paths. The selected files remain in scope, reducing manual reconfiguration and avoiding missed artifacts due to inherited filters.

Backup Encryption Status in Backup Details

The Backup Details view now shows whether encryption was enabled when each backup was created. New backups store this value at the time the backup is queued.

Existing backup records created before this release show the status as Unknown. This gives administrators better visibility into backup posture without requiring additional support checks.

Hunt/Triage and Rule Management

Improved Rule Validation Reuse

Hunt/Triage, acquisition, and interACT command validation now share common validation behavior for osquery syntax and schema checks. This improves consistency when users validate rule content or run query-based investigation actions.

For analysts, this means unsupported or invalid query content is more likely to fail early with clearer feedback instead of failing later during task execution.

Optimized Git Repository Rule Sync

Git repository synchronization now fetches repository archives for supported providers and reads file content locally during a sync. This significantly reduces the number of provider API calls required for large rule repositories.

For teams managing large Hunt/Triage rule repositories, initial syncs are less likely to hit provider rate limits and produce fewer skipped-file messages. If archive retrieval fails, AIR falls back to the existing per-file behavior.

Auto Asset Tagging

Additional Rule Operators

Auto asset tagging rules now support additional operators, including negative conditions and regex-style matching for supported fields. Examples include hostname does not contain, hostname is not, hostname does not start with, and related negative match patterns.

This helps administrators build more precise asset classification rules. For example, a rule can include assets whose hostname starts with a regional prefix while excluding assets whose hostname contains a specific platform or workload marker.

Predefined Auto Asset Tagging Rules Are Restored and Protected

AIR now verifies predefined auto asset tagging rules during startup and restores any missing predefined rules. The system also protects predefined rules from edit and delete actions while still allowing administrators to enable or disable them.

This keeps out-of-the-box tagging behavior consistent across environments and reduces the risk of losing predefined rules during maintenance or cleanup. Custom customer-created rules remain unaffected.

interACT

More Reliable interACT Session Handling

interACT run, cancel, and close operations now include asset readiness checks and improved handling for stale or warming sessions. AIR can retry during a readiness window and return clearer errors when a session is not ready.

This improves live-response reliability and helps analysts understand whether a command failed because of validation, asset readiness, or session availability.

Enterprise Connectivity and Administration

Proxy Exclusion List

Proxy settings now support an exclusion list. Administrators can define destinations that should bypass the configured proxy and be reached directly.

The exclusion list supports hostnames, wildcard domains, IP addresses, and CIDR ranges. This helps organizations where internet-bound traffic must use a proxy, but internal services such as evidence repositories must be reached directly.

The exclusion list is available in the Proxy settings UI and is applied to outbound Console connections that use the managed transport configuration.

Enhanced Proxy Testing and Troubleshooting

AIR now includes a proxy connection test with structured diagnostics. Administrators can test connectivity to a target URL without saving settings and review clearer status, duration, and categorized error information.

This improves troubleshooting in environments with strict network controls, SSL inspection, proxy authentication, or internal certificate authorities. The setup wizard also supports proxy testing before installation is completed.

Trusted CA Save Without Validation

Trusted CA certificate import now supports saving a certificate without requiring live validation. This helps proxy-only or isolated deployments where the certificate is valid but the validation target is not directly reachable.

AIR also provides clearer validation feedback and better handling for proxy CA removal, reducing the need for manual configuration changes during troubleshooting.

Bug Fixes

• Responder update task scope now respects the selected Issue filter. In a customer-reported production case, using “Select all records” with an Issue filter during a Responder update could widen the task to all updatable assets in the organization while the confirmation dialog showed the filtered count. AIR now intersects the user’s Issue filter with valid update-related issues and rejects filters that contain no updatable issue. This prevents unintended large-scale Responder update rollouts.

• Bulk action confirmation counts now preserve “No” filters. A customer-reported issue caused stats requests to drop boolean false filters such as Is Server = No, inflating confirmation counts for bulk actions. AIR now serializes false-valued filters correctly so confirmation dialogs and bulk action counts match the filtered asset set.

• Update Responder Version now closes the asset action menu. When opened from an asset detail action menu, the update panel no longer leaves the dropdown visible over the page.

• Asset update exclusion match counts now include only responder-managed asset types where applicable. Auto Responder Update Exclusion previews no longer count disk images, cloud assets, or other non-responder asset types when evaluating responder update exclusion rules.

• IP Restriction no longer marks the application container unhealthy. The internal loopback health check for application information is now exempted from IP Restriction only when it originates from loopback. External restricted clients remain blocked.

• OIDC SSO attribute mapping now persists correctly in the settings view. OIDC claim mappings are returned with the provider configuration after refresh, so administrators can confirm and maintain custom attribute mappings from AIR.

• OIDC SSO role claims now support single-string values. AIR now treats a single role claim string as a one-item role list, improving compatibility with identity providers that emit one role as a string instead of an array.

• Investigation Hub flags filtering now preserves organization scope. A crafted filter could bypass the intended organization boundary when querying custom flags. AIR now groups client filters so organization scoping remains mandatory.

• Triage tag deletion now enforces organization authorization. AIR now checks the owning organization before allowing triage tag deletion across private, public, and legacy routes.

• interACT command-snippet tag deletion now enforces organization authorization. AIR now resolves the tag’s organization before update or delete operations, preventing cross-organization changes when a foreign tag ID is known.

• User update authorization now protects higher-tier administrators. A lower-tier administrator can no longer downgrade a Global Admin or Organization Admin through user update routes and then delete the account.

• User group mutation responses no longer expose sensitive member fields. Create and update responses now return sanitized user group data, matching the safe read-path projection.

• Portable disk image package handling is hardened. Portable disk image packages no longer include repository credentials or license data, remote asset package creation is rejected, and downloads enforce privilege and organization ownership checks.

• Off-network share links now require a signature. Anonymous off-network package share links now include and verify a signed parameter before serving a file. Authenticated download behavior is unchanged.

• Package download audit events are now scoped to the owning organization. Portable and off-network package download events no longer appear as system-wide audit entries visible to unrelated organization administrators.

• Organization deletion audit visibility is restored. Organization deletion events are now scoped so the audit entry remains visible after the organization is deleted, while still recording the deleted organization’s name and identifier.

• Chained audit and syslog entries can be suppressed. AIR adds separate settings to suppress chained log entries created by indirectly affected entities, reducing noise during high-volume cleanup operations such as large asset deletions.

• Investigation report PDF generation no longer loads remote subresources. Report rendering now allows only local file and embedded data resources during PDF generation, preventing unexpected outbound requests from report content.

• Investigation report logos now reject remote URLs and unsupported values. The company logo field now accepts only supported embedded image data within size limits. Existing URL-based logo values must be replaced by uploaded images.

• Outbound redirect validation now blocks disallowed IP literal redirects. AIR validates each redirect hop for outbound HTTP requests so redirects cannot bypass network destination controls.

• Two-factor verification now includes bounded retry and replay protection. AIR now rate-limits failed two-factor and recovery attempts and prevents reuse of an already accepted time-based code within its validity window.

• Authentication endpoints now include per-source rate limiting. Login and forgot-password flows now include an additional per-source limit to reduce targeted account lockout noise while preserving existing per-account protections.

• Password policy has been strengthened. New local and API password paths now reject common weak passwords and support longer passphrases. Existing login behavior is unchanged so current users are not locked out by the policy change.

• Public JavaScript bundles no longer include all Userflow environment tokens together. Build-time environment configuration now includes only the token required for the running environment, reducing unnecessary exposure of unrelated environment identifiers.

• Organization and user group names now reject unsafe markup. AIR enforces consistent safe-name validation and prevents raw HTML-like markup from being stored in these administrative fields.

• Client-side CSV exports now defang formula-leading values. User list, imported user, evidence, task, file explorer, and report-related CSV exports now route through a shared safe export helper.

• Investigation Hub evidence pages with high finding fan-out no longer fail with server errors. AIR now deduplicates lookup keys before building comment queries, preventing excessive query bindings on evidence categories with many related findings.

• Investigation Hub Flag “Is blank” and high-volume evidence views are more stable. Query and rendering improvements reduce failures and improve feedback when large findings or evidence sets are involved.

• Task execution logs are visible after ingestion in environments using the refactored pipeline. The refactored ingestion path now populates the same task execution log data used by the Investigation Hub navigation tree.

• Temporary directory cleanup no longer follows symlinks outside the temp directory. The cleanup job now treats symlinks as links and verifies deletion paths remain inside the intended temporary directory.

• Trusted CA and proxy validation errors are clearer. Proxy-only and custom CA environments now receive improved validation handling, better error categories, and a save-without-validation option where live validation is not possible.

• S3-compatible evidence repository validation works more consistently with internal certificates and proxy settings. Outbound clients now honor configured proxy and trusted CA settings more broadly, improving validation and repository-related workflows in enterprise networks.

• RPM responder deployment commands now include the option required for unsigned packages. Generated RPM installation guidance avoids manual intervention when package signature checks would otherwise block installation.

• MITRE ATT&CK auto-update save confirmation is restored. Enabling auto-update now shows the expected confirmation and prevents form submission paths from bypassing the warning.

• Backup Details now displays encryption status correctly for new backups. Backup records now capture whether encryption was enabled when the backup was created.

• Disk image acquisition profile creation provides clearer validation and selection behavior. Inline profile creation now shows field errors correctly, keeps the drawer behavior consistent, and automatically selects a newly created profile.

• SDK acquisition task typing has been aligned with the documented response shape. The generated SDK package build no longer fails because of a mismatched assigned-task response type.

What’s New?

• Automatic Responder update exclusion rules help protect critical assets during maintenance windows. Administrators can now define named, policy-style rules that automatically exclude matching assets from automatic Responder updates. This is especially valuable for production systems such as messaging clusters, infrastructure services, and other sensitive assets where an unscheduled Responder restart could disrupt investigation readiness or business operations.

• Expanded macOS artifact coverage improves visibility into user activity. AIR now expands KnowledgeC collection coverage with additional macOS activity streams, including application focus, web usage, lock and power state indicators, audio output, media activity, and modern macOS activity streams. This gives analysts broader context when reconstructing user activity during security investigations.

• Task memory-limit configuration is available across acquisition, Hunt/Triage, and Full Text Search workflows. Memory-limit settings are now available in task advanced options and policy configuration. This helps administrators control task impact on production assets while preserving the ability to collect and analyze evidence at scale.

• Linux file system enumeration now includes mounted local filesystems. File System Enumeration on Linux assets now covers eligible local mounted disks and volumes, not only the root filesystem. Virtual, pseudo, volatile, container, and network filesystems remain excluded by default to avoid unstable runtime trees and performance issues.

New Features & Improvements

AIR Console — Asset and Responder Administration

Automatic Responder Update Exclusion Rules

AIR now supports automatic Responder update exclusion based on saved asset filter rules. Administrators can define one or more named rules under asset update settings, and any asset that matches an enabled rule is automatically excluded from automatic Responder updates.

This improvement is designed for environments where critical systems must be updated only during approved maintenance windows. For example, an administrator can create a rule that matches assets tagged as production infrastructure or sensitive Linux servers. Newly registered assets or assets that receive matching tags later are handled automatically, without requiring manual bulk updates.

The rule-based exclusion is additive with the existing per-asset manual exclusion flag. Manual Responder update actions remain available, so administrators can still update excluded assets deliberately when they are ready.

The asset detail page now also shows which update exclusion rules match the selected asset. This gives administrators a clear explanation of why an asset is being skipped by the automatic update workflow.

Safer Bulk Uninstall and Purge Operations

Bulk uninstall, purge, and uninstall-with-purge operations now support an optional maximum matched-asset assertion. If the filter matches more assets than the configured threshold, AIR stops the operation before making changes.

This is useful for cleanup scripts and scheduled administration workflows where filters may evolve over time. Administrators can use the assertion as a guardrail to prevent accidental removal of more assets than intended.

When no assets match the filter, AIR now returns a clearer not-found response instead of silently proceeding. This helps administrators identify filter mistakes before they rely on automation.

Policy-Based Memory Limit Configuration for Tasks

Memory limit configuration is now available in task advanced options and policy configuration. AIR also passes resource-limit fields through Hunt/Triage and Full Text Search task flows so the configured limits are preserved when tasks are submitted.

This improvement helps administrators control resource consumption on production assets. For investigation teams, it supports safer evidence collection and analysis by reducing the chance that long-running or high-volume tasks consume more memory than expected.

Administrators can configure these limits as part of task or policy settings, depending on the workflow. Existing task behavior remains unchanged when no limit is configured.

Improved First Responder Deployment Experience

The empty asset page now updates the “Deploy your first Responder” action correctly when license capabilities or permissions are available. This improves the onboarding experience for newly deployed AIR tenants and reduces confusion for administrators who have the required access but previously saw the action disabled.

Updated AIR For Chrome Extension Store Link

The Deploy > Chrome package page now points to the updated official Chrome Web Store listing for the AIR For Chrome extension. Quick Deployment actions such as Copy Link to Chrome Store and Add to Chrome now open the updated extension URL.

This ensures administrators and analysts are directed to the current official AIR For Chrome extension when deploying the standalone collector.

Settings and Administration

Additional Month-First Date Formats

User date and time preferences now include additional month-first date format options. These formats better support users in regions where month-first dates are the standard.

Users can select these formats from Profile > Date & Time Preferences. This improves readability in investigation timelines, reports, and operational views for teams that use month-first date conventions.

Improved License Validation Feedback

License validation now preserves the license server’s response more accurately when the license key is invalid or not found. AIR now distinguishes invalid-license scenarios from license server connectivity issues more clearly.

This reduces troubleshooting time for administrators and support teams by pointing them toward the correct root cause, such as an invalid key or capacity condition, instead of suggesting a network issue.

Improved Console Address Certificate Import Flow

The Console Address certificate import flow now handles custom PFX imports more reliably when the Console Address itself is unchanged. The import modal also prevents the PFX password from appearing in the browser URL.

This improves both usability and credential handling for administrators configuring Console Address certificates under Settings > General > Connection > Console Address.

Responder and Evidence Collection

Expanded macOS KnowledgeC Artifact Coverage

AIR expands macOS KnowledgeC parsing with additional high-value activity streams. New parsed streams include application focus, web usage, device lock state, power connection state, battery percentage, audio output route, media now-playing activity, application media usage, and application intents where present on the asset.

These artifacts help analysts build a more complete timeline of user activity and system state during an investigation. For example, application focus and media usage can help confirm whether a user was active, which applications were in use, and how activity correlates with other evidence.

Raw KnowledgeC data collection remains available, while the expanded parsed coverage makes more of the data directly searchable and usable inside AIR workflows.

Linux Shell History Collection for Domain and NSS Users

Linux shell history collection now accounts for user home directories that exist under /home even when the user is not listed in the local password file. This improves coverage for environments that resolve users through directory services or similar identity integrations.

For investigation teams, this reduces the chance of missing command history from domain or externally managed users whose home directories are present on disk. The collector keeps discovery bounded by scanning immediate home directories rather than recursively walking the entire filesystem.

Linux File System Enumeration Now Includes Mounted Local Filesystems

Linux File System Enumeration now enumerates the root filesystem plus eligible local mounted filesystems. Previously, mount points such as /mnt, /media, /srv, and /afs could appear as single directory entries while their mounted contents were absent from FileSystemEnumeration.csv.

AIR applies a Linux-specific traversal policy for eligible local mounts while continuing to exclude virtual, pseudo, volatile, container, and network filesystems by default. Darwin and AIX root-device behavior is unchanged.

For investigation teams, this improves filesystem visibility on Linux assets where evidence is spread across multiple mounted disks or volumes, without expanding collection into unstable runtime or network-backed trees.

Responder Upgrade Safety on Linux Hosts

Linux Responders no longer flush the full connection tracking table on every service start. The cleanup now runs only when isolation artifacts are present and cleanup is actually required.

This change prevents brief network disruptions on NAT-dependent production workloads during Responder updates. It is especially relevant for customers running clustered infrastructure where even a sub-second connection reset can cause service impact.

DRONE Event Classification Improvement

DRONE now classifies Windows Event ID 104 as “Event Log Cleared” only when the provider matches the Windows event log provider. This prevents unrelated USB or smart card driver events from being reported as event log clearing activity.

This reduces false positives and helps analysts focus on activity that is more likely to be relevant during an investigation.

Bug Fixes

• Audit log event filtering now behaves more consistently across Console processes. Customer-reported issues where event filter settings appeared stale or inconsistent after changes have been addressed. Saved audit log event filter settings are now invalidated across running processes, and the settings read path reflects the latest saved configuration more reliably. This improves confidence when administrators use “Log only selected events” or “Log all except selected events” to reduce audit log noise.

• Audit log filtering controls now better preserve administrator intent. AIR improves handling around audit event selection modes so administrators can switch between logging modes with less risk of losing or misapplying selected event filters.

• Outbound connector validation has been hardened across AIR Console integrations. AIR now applies a secure-by-default outbound destination validator to Console-initiated requests, including Git repository validation, event subscriptions, evidence repository validation, directory services validation, syslog validation, proxy validation, and related connector checks. SaaS deployments block non-public and cloud-metadata destinations, while on-premise deployments preserve legitimate internal connectivity with configurable allow-list controls.

• Investigation Hub query handling has been secured and parameterized. Time-based and second-order query injection paths in Investigation Hub timeline count and finding exclusion-rule workflows have been fixed. Stored values are treated as untrusted at use time, and affected query paths now use safer parameter handling.

• Investigation Hub object-scope checks have been tightened. AIR now enforces authorization more consistently when listing, creating, or applying Investigation Hub exclusion rules and when building asset summary data. This prevents users from expanding results or writing exclusion rules outside their permitted investigation scope.

• Stored script execution in Investigation Hub asset filters has been fixed. Asset and assignment names displayed in the Evidence Assets filter are now escaped before highlighting. Server-side validation was also added to prevent unsafe asset-name input in section creation workflows. This protects analysts from stored script execution when viewing investigation report-generation filters.

• Investigation Hub search results now open records more reliably on large datasets. AIR optimized the search-to-grid path so selecting artifact search hits is less likely to result in a timeout or an empty records view when matching data exists.

• The “New evidence has been added” toast no longer appears incorrectly for task-assignment investigations. AIR now suppresses this notification for investigations that are permanently scoped to a single task assignment, avoiding confusion when the initial import completes while an analyst is already viewing the Investigation Hub.

• Findings CSV export no longer duplicates the “Flags” column. Exported findings now contain a single human-readable Flags column, allowing the CSV to be re-imported without duplicate-header errors.

• The Platform “Add to Filter” action in finding details now creates a valid advanced filter. AIR now falls back to an allowed operation when the requested filter operation is not supported by the selected field.

• Remote repository browsing no longer shows stale results during rapid search or navigation. AIR now ignores superseded repository list responses so slow responses from earlier requests do not overwrite newer search results.

• Date pattern changes no longer fail because of unchanged profile name fields. Date and time preference saves now submit only the relevant preference data, so users with identity-provider-managed names containing restricted characters can still update date formatting.

• Additional month-first date formats are now available. Users can choose formats such as month/day/year and month-day-year variants from Date & Time Preferences.

• Invalid license keys now produce clearer validation messages. AIR no longer reports a license server connectivity problem when the server is reachable and the actual issue is an invalid or missing license key.

• PFX import no longer exposes the PFX password in the URL. The certificate import modal prevents native form submission and keeps sensitive certificate passwords out of client-visible locations.

• The “Deploy your first Responder” button now updates correctly on new tenants. The empty asset page now reflects current permissions and license features reactively, so eligible administrators can start deployment without refreshing or navigating away.

• Responder reinstall handling on Linux has been improved. AIR addresses a scenario where an older Responder process could remain running after uninstall and block the newly installed service from starting because the previous process still held the runtime lock.

• Responder updates are safer for NAT-dependent Linux workloads. A startup cleanup path that could briefly reset established network flows on certain Linux hosts has been fixed. Customers running affected Responder versions should upgrade to the fixed Responder release before resuming automatic updates on sensitive clustered workloads.

• DRONE no longer reports unrelated USB or smart card driver events as event log clearing. Event classification now checks the provider, reducing false positives in Windows event analysis.

• A restrictive Permissions-Policy response header has been added. AIR now explicitly disables access to browser features such as geolocation, camera, microphone, payment, USB, and motion sensors unless they are intentionally enabled in the future.

• Console-initiated outbound requests now sanitize failure behavior more consistently. Connector validation paths no longer rely on inconsistent destination filtering, reducing internal reachability exposure in SaaS environments.

• API token metadata visibility has been improved for integrations. External consumers can retrieve token details such as expiration date, enabling better token renewal warnings and reducing failed automation caused by expired credentials.

• Background worker consistency for audit logging has been improved. Multiple Console containers and workers now receive audit log setting changes more reliably, reducing discrepancies between saved settings and logged events.

What’s New?

• Expanded Windows event collection coverage: Acquisition profiles now include additional relevant Windows Event IDs. This increases visibility into activity that may be important during security investigations and retrospective analysis..
• Improved interACT file download experience: interACT command result downloads now include file size information, enabling progress indication for larger files and improving the experience for analysts and external integrations.
• Investigation Hub usability improvements: A Toolbox button is now available in the Investigation Hub header, making related investigation actions easier to access during active case review.

New Features & Improvements

Responder and Task Execution

Expanded Windows Event Collection Coverage

AIR acquisition profiles now include additional Windows Event IDs that are relevant to security investigations. These additions improve coverage for event-based review and help analysts identify activity that may otherwise require manual profile updates.

Administrators can use the updated acquisition configuration as part of standard evidence collection workflows. The expanded event coverage supports stronger timeline reconstruction and better evidence-backed decisions during post-incident investigation.

Investigation Hub

Toolbox Access from the Investigation Hub Header

The Investigation Hub header now includes a Toolbox button. This makes supporting actions more accessible while analysts are reviewing evidence, findings, and artifacts inside a case.

By reducing navigation friction, the change helps analysts stay focused on the active investigation context and move more quickly between review and response actions.

interACT

Improved Command Result Downloads

interACT command result downloads now include the content length in the response. This allows browsers and integrations to display accurate progress for larger downloads.

The improvement is useful when analysts retrieve larger command outputs or files through interACT. It reduces uncertainty during downloads and provides a clearer indication that the file transfer is progressing.

Bug Fixes

• Responder startup no longer disrupts Linux connection tracking when isolation was not used. A Linux Responder startup path could clear host connection tracking during upgrade or service restart, even on assets where network isolation had never been used. This could briefly disrupt NAT-dependent clustered workloads. The cleanup now runs only when isolation artifacts are present, preserving normal network state during routine Responder updates.
• Acquisition now stops immediately on disk-full write errors. When a collector encounters a no-space-left condition during evidence collection, AIR now cancels the acquisition pipeline immediately instead of allowing additional collectors to continue failing and generating excessive logs. This reduces wasted processing and improves clarity when an asset lacks sufficient disk space.
• Console proxy settings are now applied to license validation in on-premise deployments. License validation now respects the configured Console proxy. This resolves failures in environments where outbound internet access must pass through a proxy and avoids misleading situations where proxy verification succeeds but license validation bypasses the proxy.
• RelayPro registration now works correctly in multiport Console configurations. RelayPro agent-facing registration and communication endpoints are now accepted through the supported Responder communication path. This resolves 403 “Console Port Forbidden” errors that prevented RelayPro from registering in affected on-premise configurations.
• Fresh installations now create the required File Explorer processor configuration. AIR now creates the required File Explorer processor during installation. This resolves Repository Explorer failures where the supporting service was healthy but AIR reported that the processor was not configured.
• Investigation Hub export URLs now resolve correctly. The Investigation Evidence Export Request API now returns a usable download URL. API users can create an export request and retrieve the generated CSV instead of receiving a 404 response from the returned URL.
• Investigation Hub filtering has been improved for large findings datasets. The Flag “Is blank” advanced filter has been optimized so large findings views do not become unresponsive or fail because of long-running queries. This improves review workflows for cases containing a high volume of findings.
• Artifact data now remains visible when filtering by affected assets. AIR fixed an Investigation Hub issue where artifact data could disappear from the left-side panel after applying certain asset filters. Clearing filters is no longer required to restore the artifact view.
• Investigation Hub evidence relationship handling has been corrected. AIR fixed an issue that affected evidence relationship display and correlation inside Investigation Hub, improving consistency when analysts review linked artifacts and findings.
• Advanced filter value lists now show expected available values. AIR fixed an issue where some valid filter values did not appear in Advanced Filter controls across areas such as Assets and Tasks. Analysts and administrators can now select available environment values more reliably.
• Asset selection now matches the task scope for Triage tasks. AIR fixed an issue where the selection count could include assets selected across multiple filtered views, while the resulting Triage task only processed assets from the latest filter view. Task creation now better reflects the intended asset selection.
• Disk Image and Repository Explorer search behavior has been corrected. Search filtering now works more reliably when selecting repositories or browsing disk image lists, helping analysts locate relevant evidence sources faster.
• PFX certificate import messaging and trust handling have been improved. AIR now handles PKCS12 certificate conversion and certificate chain validation more reliably, with clearer guidance when certificate trust issues are detected.
• License error messages now better reflect the actual condition. AIR now provides more accurate license validation feedback, reducing confusion between capacity-related conditions and connectivity problems.
• MITRE notification formatting has been corrected. Analyzer database change notifications now render more cleanly, improving readability for administrators reviewing update information.
• Bulk case closure now reduces load on cache services. AIR no longer proactively scans and removes large numbers of investigation jobs when a case is closed. Job processors now check case state when processing and skip work for closed cases, reducing load during bulk closure operations.
• Task assignment reads no longer include large response payloads by default. AIR avoids loading large task assignment response data unless needed. This improves performance in environments where task responses contain large JSON bodies, such as auto asset tag responses.
• Auto-tag organization isolation has been corrected. Auto asset tags are now filtered by organization during assignment and scheduled processing. This prevents tags configured for one organization from appearing in another organization’s cases or assets.
• Security and authorization hardening has been applied across tenant-scoped workflows. AIR corrected cross-organization authorization gaps in Investigation Hub advanced filters, finding exclusion rules, and asset tag deletion. These fixes strengthen tenant boundaries and prevent unauthorized cross-organization modification of saved searches, exclusion rules, and tags.
• Audit log filtering has been hardened. AIR now safely handles user-supplied audit log filter keys, preventing unsafe query construction while preserving existing filtering behavior.
• SSO provider data remains current after configuration changes. AIR now invalidates cached SSO provider data when providers are created, updated, or deleted, ensuring administrators see current authentication configuration.
• Integration settings load more efficiently. AIR improved integration settings retrieval performance, reducing delays for administrators working with cloud and repository integrations.
• Setup and role seeding reliability has been improved. AIR fixed a race condition between setup and predefined role seeding, improving reliability during installation and provisioning.

What’s New?

• Expanded Windows Clipboard History visibility: AIR now surfaces Clipboard History and Clipboard Activity artifacts in Investigation Hub. This helps analysts review copied text activity, user workflow context, and clipboard-related evidence when investigating suspicious behavior on Windows assets.
• S3-compatible evidence repository support: AIR now supports custom S3-compatible storage providers, including common object storage platforms that use S3-compatible APIs. This gives security teams more flexibility when storing collected evidence in restricted, hybrid, or customer-managed environments.
• Improved export workflows for reporting and correlation: Export behavior has been expanded with configurable CSV delimiters, UTF-8 BOM support, timezone options, and column-selection-aware exports. Analysts can now generate cleaner, locale-compatible outputs that better match what they see in AIR.
• Configurable audit logging: Administrators can now control which audit events are written to the Audit Log. This helps reduce noise, focus on high-value security events, and support compliance-driven monitoring requirements.
• More controlled auto asset tagging: Auto Asset Tagging can now be managed more selectively, allowing teams to enable or disable specific tagging rules. This helps SOC and MSSP teams apply automation more precisely across different customer or organizational environments.

New Features & Improvements

Investigation Hub

Investigator Toolbox for In-Hub Analysis

Investigation Hub now includes entry points for an Investigator Toolbox from evidence detail views. Analysts can open selected field values in the toolbox directly from the evidence context, reducing the need to copy values into external utilities during an investigation.

This improvement supports faster evidence review by keeping common analysis actions close to the data. Values such as encoded strings, timestamps, hashes, IP addresses, domains, registry paths, and other artifacts can be reviewed with less context switching.

For investigation teams, this improves continuity during evidence-based investigations. Analysts can move from observation to enrichment more quickly while preserving the context of the case and the original evidence item.

Export Options for Investigation Reporting

AIR export workflows now provide more flexibility for teams that rely on CSV outputs for reporting, correlation, and downstream analysis. Exports can be configured with delimiter options such as comma, semicolon, tab, or pipe, and can include UTF-8 BOM support for improved compatibility with regional spreadsheet settings.

This is valuable for organizations using Turkish or European locale settings, where spreadsheet tools may expect semicolon-separated files. Analysts can produce files that open correctly without manual conversion steps.

Export workflows also include timezone-related controls for Investigation Hub flag exports, helping analysts generate outputs that match investigation and reporting requirements across different operating regions.

Exports Now Respect Visible Column Selection

Non-Investigation Hub exports now support exporting the columns currently visible in the UI. When analysts hide columns through column selection, exported CSV files can now reflect that visible selection instead of always exporting every available column.

This improves data minimization and reporting accuracy. Analysts can export only the fields needed for a report or handoff, reducing unnecessary internal identifiers, sensitive values, or irrelevant operational data in exported files.

Evidence Collection

Windows Clipboard History Evidence

AIR now integrates Windows Clipboard History evidence into the acquisition profile and Investigation Hub. Clipboard History and Clipboard Activity are available as Windows artifact sources, with parsed activity status values displayed in a readable format.

This helps analysts review clipboard-related user activity when Clipboard History is available on the asset. Clipboard evidence can support investigations involving copied commands, copied URLs, copied identifiers, or other text values that may be relevant to adversary techniques or unauthorized activity.

The new evidence appears in Investigation Hub under the Windows evidence navigation structure and uses the standard evidence grid experience. Analysts can review, filter, and correlate clipboard-related records with other collected evidence in the same case.

Evidence Repository and Storage

S3-Compatible Evidence Repositories

AIR now supports a dedicated S3-compatible evidence repository type. Administrators can configure a custom endpoint, provider name, and region for object storage platforms that use S3-compatible APIs.

This expands evidence repository options beyond standard cloud storage configurations. Organizations using providers such as Backblaze B2, Pure Storage, MinIO, Wasabi, Cloudflare R2, or similar S3-compatible services can configure evidence upload destinations more directly.

Custom Azure Blob Storage Domains

AIR now supports custom Azure Blob Storage domains in evidence repository configuration. This addresses environments that use custom storage domains instead of the standard public Azure Blob Storage domain format.

This is important for organizations operating in restricted or contained network environments. Administrators can configure storage destinations that match their network architecture, allowing acquisition workflows to upload evidence without requiring workarounds.

Evidence Repository Filtering, Sorting, and Last-Used Details

Evidence repository lists now provide improved filtering and sorting for S3-compatible providers. Repository type and provider values are handled more consistently, including provider names entered as free text.

Repositories can also be sorted by last-used information, helping administrators quickly identify active storage destinations and review repository usage patterns. This is useful in environments with multiple organizations, storage providers, or regional evidence destinations.

Access, Authentication, and Governance

SSO Custom Claim Mapping

Administrators can now define custom claim mappings for SSO providers. AIR supports mapping identity provider attributes to expected AIR fields such as email, first name, last name, and groups.

This improves compatibility with identity providers that use different claim or attribute names. Administrators can adapt AIR to existing identity configurations without requiring custom changes or provider-specific workarounds.

The improvement supports both OIDC and SAML-based SSO configurations and helps enterprise teams integrate AIR into established authentication environments more efficiently.

Self-Service 2FA Device Change

Users can now change their authenticator device through a guided self-service flow. The user verifies the current authenticator code, scans a new authenticator secret, and confirms the new code before the old secret is replaced.

This provides a graceful transition when users replace a phone, move to a new authenticator application, or update corporate devices. The old authenticator remains valid until the new one is verified, so the account does not lose 2FA protection during the change.

Personal Access Token Access Control

AIR now includes a dedicated privilege for managing personal access tokens. Administrators can control whether users can view, create, edit, or delete personal access tokens.

This gives security teams more precise control over API access and automation credentials. Organizations can limit token management to approved roles while preserving existing operational workflows for users who require token-based integrations.

Configurable Audit Logging

Administrators can now configure which event types are written to the Audit Log. The new event filter supports logging all events, logging only selected events, or logging all events except selected events.

This helps teams reduce audit noise and focus on activity that matters most to their governance, compliance, and security monitoring requirements. Changes to audit logging configuration are themselves recorded, helping maintain traceability over audit policy changes.

License Usage Banners

AIR now provides clearer license usage notifications through visible banners at higher usage thresholds. These banners help administrators understand when asset usage is approaching important license limits.

Asset and Task Management

Selective Auto Asset Tagging Rules

Auto Asset Tagging can now be controlled at the rule level. Administrators can enable or disable individual rules instead of relying only on a global auto-tagging switch.

This helps teams run only the tagging rules that are relevant to a specific environment, organization, or customer. MSSP teams can reduce noisy tagging behavior and test new rules without activating every rule in the library.

Bug Fixes

• Investigation Hub advanced filters: Fixed an issue where invalid filter options could appear for some columns in the advanced filter panel.
• Investigation Hub exclusion activity: Fixed an issue where exclusion rule creation activity was displayed incorrectly and was not clickable in the Activity view.
• Investigation Hub flags after organization changes: Fixed an issue where incorrect flags could be shown or assigned after changing an investigation organization.
• DRONE analysis rerun at scale: Fixed a case-level DRONE re-analysis workflow that generated one request and one toast per asset assignment. The workflow now batches the action more effectively and shows a single summary notification, improving usability in large cases.
• Exclusion rule modal usability: Improved the Exclusion Rule modal layout so action controls remain accessible on common screen sizes and users do not need to search for the submit action inside the scroll area.
• Exclusion toast behavior: Exclusion confirmation toasts now auto-dismiss after a short duration instead of remaining on screen indefinitely.
• Export timestamp precision: Fixed an issue where some exported date and time formats did not include seconds. Exported timestamps now provide consistent precision across supported timezone options.
• Matched policies after isolation actions: Fixed an issue where the Matched Policies section disappeared after isolate or unisolate actions until the page was refreshed.
• Policy search: Fixed an issue where searching on the Policies page did not filter the displayed policy list.
• Cases page search field: Fixed a UI issue where the search input on the Cases page was too narrow, making typed text difficult to see.
• Task Details table spacing: Adjusted default table spacing on the Task Details page to improve readability and screen usage.
• interACT REST polling: Fixed an issue where public interACT REST API polling could continue returning an in-progress state after the command had already completed.
• MITRE ATT&CK database version validation: Fixed an issue where the API accepted a non-existent MITRE ATT&CK database version before task creation. Invalid versions are now validated earlier.
• Backup restore completeness: Fixed an issue where a backup archive could miss the primary database dump in larger environments, causing restore results to appear incomplete in the UI.
• Backup creation options: Removed a misleading unused database option from the backup creation workflow to reduce confusion and avoid unnecessary backup size growth.
• Application health after install or upgrade: Fixed a health check validation issue that could cause an application container to be reported as unhealthy after a fresh installation or upgrade.
• Evidence repository configuration: Fixed and refined S3-compatible repository form behavior, provider display, and save handling for repository configuration workflows.
• Custom Azure Blob Storage validation: Fixed validation so custom Azure Blob Storage domains can be used where supported by the evidence repository configuration.