Binalyze AIR Extended
Manage Binalyze AIR forensic acquisition, endpoint isolation, triage, cases, tasks, assets, repositories, and evidence artifacts from Cortex XSOAR.
Forensics & Malware Analysis · Binalyze AIR Extended
Details
| ID | Binalyze AIR Extended |
|---|---|
| Provider | Binalyze |
| Category | Forensics & Malware Analysis |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
Manage Binalyze AIR forensic acquisition, endpoint isolation, triage, cases, tasks, assets, repositories, and evidence artifacts from Cortex XSOAR.
This integration was integrated and tested with Binalyze AIR Extended.
Configure Binalyze AIR Extended in Cortex
| Parameter | Description | Required |
|---|---|---|
| Binalyze AIR Server URL | The Binalyze AIR Server URL, for example https://air.example.com. | True |
| API Key | The Binalyze AIR API token, for example api_1234567890abcdef1234567890abcdef. | True |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
binalyze-air-isolate
Isolate an endpoint or release endpoint isolation.
Base Command
binalyze-air-isolate
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | The endpoint hostname. | Required |
| organization_id | The organization ID of the endpoint. | Required |
| isolation | The isolation action to perform. Possible values are: enable, disable. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Isolate.Result.ID | string | The isolation task ID. |
| BinalyzeAIR.Isolate.Result.Name | string | The isolation task name. |
| BinalyzeAIR.Isolate.Result.OrganizationID | number | The endpoint organization ID. |
binalyze-air-acquire
Start forensic evidence acquisition from an endpoint.
Base Command
binalyze-air-acquire
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | The endpoint hostname. | Required |
| profile | The acquisition profile name. Possible values are: compromise-assessment, browsing-history, event-logs, memory-ram-pagefile, quick, full. | Required |
| case_id | The Binalyze AIR case ID. | Required |
| organization_id | The organization ID of the endpoint. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Acquire.Result.ID | string | The acquisition task ID. |
| BinalyzeAIR.Acquire.Result.Name | string | The acquisition task name. |
| BinalyzeAIR.Acquire.Result.OrganizationID | number | The endpoint organization ID. |
binalyze-air-create-case
Create a Binalyze AIR case.
Base Command
binalyze-air-create-case
Input
| Argument Name | Description | Required |
|---|---|---|
| name | The case name. | Required |
| organization_id | The organization ID. | Required |
| owner_user_id | The owner user ID. | Required |
| visibility | The case visibility. Possible values are: public-to-organization, private-to-users, Public to Organization, Private to Users. | Required |
| assigned_user_ids | A comma-separated list of assigned user IDs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Case.Result.ID | string | The case ID. |
| BinalyzeAIR.Case.Result.Name | string | The case name. |
binalyze-air-get-case
Get a Binalyze AIR case by ID.
Base Command
binalyze-air-get-case
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The case ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Case | unknown | The case details. |
binalyze-air-list-cases
List Binalyze AIR cases.
Base Command
binalyze-air-list-cases
Input
| Argument Name | Description | Required |
|---|---|---|
| name | The optional case name filter. | Optional |
| organization_id | The optional organization ID filter. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Cases | unknown | The case list response. |
binalyze-air-close-case
Close a Binalyze AIR case.
Base Command
binalyze-air-close-case
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The case ID. | Required |
| reason | The closure reason. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.CloseCase | unknown | The close case response. |
binalyze-air-get-case-tasks
Get tasks associated with a Binalyze AIR case.
Base Command
binalyze-air-get-case-tasks
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The case ID. | Required |
| task_id | The optional task ID filter. | Optional |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.CaseTask | unknown | The case task response. |
binalyze-air-get-case-endpoints
Get endpoints associated with a Binalyze AIR case.
Base Command
binalyze-air-get-case-endpoints
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The case ID. | Required |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.CaseEndpoint | unknown | The case endpoint response. |
binalyze-air-get-case-activities
Get activity history associated with a Binalyze AIR case.
Base Command
binalyze-air-get-case-activities
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The case ID. | Required |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.CaseActivity | unknown | The case activity response. |
binalyze-air-list-assets
List Binalyze AIR endpoints/assets with optional filters.
Base Command
binalyze-air-list-assets
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | The optional endpoint hostname filter. | Optional |
| organization_id | The optional organization ID filter. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
| online_status | A comma-separated list of values. | Optional |
| isolation_status | A comma-separated list of values. | Optional |
| platform | A comma-separated list of values. | Optional |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Asset | unknown | The asset list response. |
binalyze-air-get-asset
Get a Binalyze AIR endpoint/asset by asset ID.
Base Command
binalyze-air-get-asset
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | The asset ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Asset | unknown | The asset details. |
binalyze-air-get-asset-by-hostname
Find a Binalyze AIR endpoint/asset by hostname and organization ID.
Base Command
binalyze-air-get-asset-by-hostname
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | The endpoint hostname. | Required |
| organization_id | The organization ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Asset.Result | unknown | The first matching asset. |
binalyze-air-get-asset-tasks
Get tasks associated with an endpoint/asset.
Base Command
binalyze-air-get-asset-tasks
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | The asset ID. | Required |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.AssetTask | unknown | The asset task response. |
binalyze-air-get-task
Get task details and normalized terminal status flags for polling.
Base Command
binalyze-air-get-task
Input
| Argument Name | Description | Required |
|---|---|---|
| task_id | The task ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Task.Result | unknown | The task details. |
| BinalyzeAIR.Task.Status | string | The normalized task status. |
| BinalyzeAIR.Task.IsDone | boolean | Whether the task is in a terminal state. |
| BinalyzeAIR.Task.IsSuccess | boolean | Whether the task completed successfully. |
binalyze-air-list-tasks
List Binalyze AIR tasks.
Base Command
binalyze-air-list-tasks
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The optional case ID filter. | Optional |
| organization_id | The optional organization ID filter. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
| status | The optional status filter. | Optional |
| task_type | The optional task type filter. | Optional |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Task | unknown | The task list response. |
binalyze-air-get-task-assignments
Get task assignment details for a Binalyze AIR task.
Base Command
binalyze-air-get-task-assignments
Input
| Argument Name | Description | Required |
|---|---|---|
| task_id | The task ID. | Required |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TaskAssignment | unknown | The task assignment response. |
binalyze-air-create-triage-rule
Create a YARA, Sigma, or osquery triage rule.
Base Command
binalyze-air-create-triage-rule
Input
| Argument Name | Description | Required |
|---|---|---|
| description | The rule description. | Optional |
| rule | The rule content. | Required |
| engine | The rule engine. Possible values are: yara, sigma, osquery. | Required |
| search_in | The search scope. Possible values are: system, memory, both, event-records. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TriageRule | unknown | The created triage rule response. |
binalyze-air-update-triage-rule
Update an existing triage rule.
Base Command
binalyze-air-update-triage-rule
Input
| Argument Name | Description | Required |
|---|---|---|
| rule_id | The triage rule ID. | Required |
| description | The rule description. | Optional |
| rule | The rule content. | Optional |
| search_in | The search scope. Possible values are: system, memory, both, event-records. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TriageRule | unknown | The updated triage rule response. |
binalyze-air-validate-triage-rule
Validate a YARA, Sigma, or osquery triage rule before assignment.
Base Command
binalyze-air-validate-triage-rule
Input
| Argument Name | Description | Required |
|---|---|---|
| rule | The rule content. | Required |
| engine | The rule engine. Possible values are: yara, sigma, osquery. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TriageRuleValidation.Result | unknown | The validation result payload. |
| BinalyzeAIR.TriageRuleValidation.Success | boolean | Whether validation succeeded. |
binalyze-air-list-triage-rules
List triage rules.
Base Command
binalyze-air-list-triage-rules
Input
| Argument Name | Description | Required |
|---|---|---|
| organization_id | The optional organization ID filter. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
| engine | The optional rule engine filter. Possible values are: yara, sigma, osquery. | Optional |
| search_in | The optional search scope filter. Possible values are: system, memory, both, event-records. | Optional |
| description | The optional description filter. | Optional |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TriageRule | unknown | The triage rule list response. |
binalyze-air-get-triage-rule
Get a triage rule by ID.
Base Command
binalyze-air-get-triage-rule
Input
| Argument Name | Description | Required |
|---|---|---|
| rule_id | The triage rule ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TriageRule | unknown | The triage rule details. |
binalyze-air-delete-triage-rule
Delete a triage rule by ID.
Base Command
binalyze-air-delete-triage-rule
Input
| Argument Name | Description | Required |
|---|---|---|
| rule_id | The triage rule ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.DeleteTriageRule | unknown | The delete triage rule response. |
binalyze-air-assign-triage-task
Assign one or more triage rules to endpoints by filter.
Base Command
binalyze-air-assign-triage-task
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | The case ID. | Required |
| triage_rule_ids | A comma-separated list of triage rule IDs. | Required |
| organization_id | The organization ID. | Required |
| task_config_choice | The task configuration mode. Possible values are: use-policy, use-custom-options. Default is use-policy. | Optional |
| task_config_cpu_limit | The CPU limit. Minimum 1, maximum 100. Default is 8. | Optional |
| hostname | The endpoint hostname filter. | Optional |
| mitre_attack | Whether to enable MITRE ATT&CK mapping. Possible values are: True, False. Default is False. | Optional |
| included_endpoint_ids | A comma-separated list of included endpoint IDs. | Optional |
| excluded_endpoint_ids | A comma-separated list of excluded endpoint IDs. | Optional |
| group_id | The optional endpoint group ID. | Optional |
| group_full_path | The optional endpoint group full path. | Optional |
| isolation_status | A comma-separated list of isolation status values. | Optional |
| platform | A comma-separated list of platform values. | Optional |
| issue | The optional issue filter. | Optional |
| online_status | A comma-separated list of online status values. | Optional |
| tags | A comma-separated list of tags. | Optional |
| version | The optional agent version filter. | Optional |
| policy | The optional policy filter. | Optional |
| when | The scheduler value. Default is now. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.TriageTask | unknown | The assign triage task response. |
binalyze-air-list-acquisition-profiles
List acquisition profiles.
Base Command
binalyze-air-list-acquisition-profiles
Input
| Argument Name | Description | Required |
|---|---|---|
| name | The optional profile name filter. | Optional |
| organization_id | The optional organization ID filter. | Optional |
| organization_ids | A comma-separated list of organization IDs. | Optional |
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.AcquisitionProfile | unknown | The acquisition profile list response. |
binalyze-air-get-acquisition-profile
Get acquisition profile details by ID.
Base Command
binalyze-air-get-acquisition-profile
Input
| Argument Name | Description | Required |
|---|---|---|
| profile_id | The acquisition profile ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.AcquisitionProfile | unknown | The acquisition profile details. |
binalyze-air-list-repositories
List Binalyze AIR repositories.
Base Command
binalyze-air-list-repositories
Input
| Argument Name | Description | Required |
|---|---|---|
| page | The page number from which to start pagination. Default is 1. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Repository | unknown | The repository list response. |
binalyze-air-get-repository
Get repository details by ID.
Base Command
binalyze-air-get-repository
Input
| Argument Name | Description | Required |
|---|---|---|
| repository_id | The repository ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| BinalyzeAIR.Repository | unknown | The repository details. |
binalyze-air-download-file
Download a file from the Binalyze AIR InterACT library into the Cortex XSOAR War Room.
Base Command
binalyze-air-download-file
Input
| Argument Name | Description | Required |
|---|---|---|
| file_name | The file name to download from the InterACT library. | Required |
Context Output
There is no context output for this command
Command Examples
The command examples for all integration commands are maintained in the command_examples.txt file and were used with demisto-sdk generate-docs.
The examples are grouped logically by operation type, including assets, tasks, acquisition, cases, triage rules, acquisition profiles, repositories, file download, and endpoint response.
Configuration parameters
server— Binalyze AIR Server URL (required)api_key— (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (28)
-
binalyze-air-acquireStart forensic evidence acquisition from an endpoint.
-
binalyze-air-assign-triage-taskAssign one or more triage rules to endpoints by filter.
-
binalyze-air-close-caseClose a Binalyze AIR case.
-
binalyze-air-create-caseCreate a Binalyze AIR case.
-
binalyze-air-create-triage-ruleCreate a YARA, Sigma, or osquery triage rule.
-
binalyze-air-delete-triage-ruleDelete a triage rule by ID.
-
binalyze-air-download-fileDownload a file from the Binalyze AIR InterACT library into the Cortex XSOAR War Room.
-
binalyze-air-get-acquisition-profileGet acquisition profile details by ID.
-
binalyze-air-get-assetGet a Binalyze AIR endpoint/asset by asset ID.
-
binalyze-air-get-asset-by-hostnameFind a Binalyze AIR endpoint/asset by hostname and organization ID.
-
binalyze-air-get-asset-tasksGet tasks associated with an endpoint/asset.
-
binalyze-air-get-caseGet a Binalyze AIR case by ID.
-
binalyze-air-get-case-activitiesGet activity history associated with a Binalyze AIR case.
-
binalyze-air-get-case-endpointsGet endpoints associated with a Binalyze AIR case.
-
binalyze-air-get-case-tasksGet tasks associated with a Binalyze AIR case.
-
binalyze-air-get-repositoryGet repository details by ID.
-
binalyze-air-get-taskGet task details and normalized terminal status flags for polling.
-
binalyze-air-get-task-assignmentsGet task assignment details for a Binalyze AIR task.
-
binalyze-air-get-triage-ruleGet a triage rule by ID.
-
binalyze-air-isolateIsolate an endpoint or release endpoint isolation.
-
binalyze-air-list-acquisition-profilesList acquisition profiles.
-
binalyze-air-list-assetsList Binalyze AIR endpoints/assets with optional filters.
-
binalyze-air-list-casesList Binalyze AIR cases.
-
binalyze-air-list-repositoriesList Binalyze AIR repositories.
-
binalyze-air-list-tasksList Binalyze AIR tasks.
-
binalyze-air-list-triage-rulesList triage rules.
-
binalyze-air-update-triage-ruleUpdate an existing triage rule.
-
binalyze-air-validate-triage-ruleValidate a YARA, Sigma, or osquery triage rule before assignment.
# Connectivity !binalyze-air-list-assets hostname="WIN-IR-001" organization_id="1" page="1" limit="50" # Assets !binalyze-air-list-assets hostname="WIN-IR-001" organization_id="1" online_status="online" isolation_status="none" platform="windows" page="1" limit="50" !binalyze-air-get-asset asset_id="12345" !binalyze-air-get-asset-by-hostname hostname="WIN-IR-001" organization_id="1" !binalyze-air-get-asset-tasks asset_id="12345" page="1" limit="50" # Tasks !binalyze-air-get-task task_id="9001" !binalyze-air-list-tasks case_id="1001" organization_id="1" status="completed" task_type="acquisition" page="1" limit="50" !binalyze-air-get-task-assignments task_id="9001" page="1" limit="50" # Acquisition !binalyze-air-acquire hostname="WIN-IR-001" profile="quick" case_id="1001" organization_id="1" # Cases !binalyze-air-create-case name="Suspicious Endpoint Investigation" organization_id="1" owner_user_id="42" visibility="public-to-organization" assigned_user_ids="42,43" !binalyze-air-get-case case_id="1001" !binalyze-air-list-cases organization_id="1" name="Suspicious Endpoint Investigation" page="1" limit="50" !binalyze-air-close-case case_id="1001" reason="Investigation completed" !binalyze-air-get-case-tasks case_id="1001" page="1" limit="50" !binalyze-air-get-case-endpoints case_id="1001" page="1" limit="50" !binalyze-air-get-case-activities case_id="1001" page="1" limit="50" # Triage Rules !binalyze-air-create-triage-rule engine="yara" search_in="system" organization_ids="1" rule="rule Suspicious_File { condition: true }" description="Suspicious file triage rule" !binalyze-air-update-triage-rule rule_id="2001" search_in="system" organization_ids="1" rule="rule Suspicious_File_Updated { condition: true }" description="Updated suspicious file triage rule" !binalyze-air-validate-triage-rule engine="yara" rule="rule Suspicious_File { condition: true }" !binalyze-air-list-triage-rules organization_id="1" engine="yara" search_in="system" description="Suspicious" page="1" limit="50" !binalyze-air-get-triage-rule rule_id="2001" !binalyze-air-delete-triage-rule rule_id="2001" !binalyze-air-assign-triage-task case_id="1001" triage_rule_ids="2001,2002" organization_id="1" task_config_choice="use-policy" task_config_cpu_limit="8" hostname="WIN-IR-001" mitre_attack="False" when="now" # Acquisition Profiles !binalyze-air-list-acquisition-profiles organization_id="1" name="quick" page="1" limit="50" !binalyze-air-get-acquisition-profile profile_id="3001" # Repositories !binalyze-air-list-repositories page="1" limit="50" !binalyze-air-get-repository repository_id="4001" # File Download !binalyze-air-download-file file_name="case-1001/evidence.zip" # Endpoint Response !binalyze-air-isolate hostname="WIN-IR-001" organization_id="1" isolation="enable"