Binalyze AIR Extended

Manage Binalyze AIR forensic acquisition, endpoint isolation, triage, cases, tasks, assets, repositories, and evidence artifacts from Cortex XSOAR.

Category

Forensics & Malware Analysis

Pack

BinalyzeAIRExtended

Configuration parameters

• server — Binalyze AIR Server URL (required)
• api_key — (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (28)

• binalyze-air-acquire — Start forensic evidence acquisition from an endpoint.
• binalyze-air-assign-triage-task — Assign one or more triage rules to endpoints by filter.
• binalyze-air-close-case — Close a Binalyze AIR case.
• binalyze-air-create-case — Create a Binalyze AIR case.
• binalyze-air-create-triage-rule — Create a YARA, Sigma, or osquery triage rule.
• binalyze-air-delete-triage-rule — Delete a triage rule by ID.
• binalyze-air-download-file — Download a file from the Binalyze AIR InterACT library into the Cortex XSOAR War Room.
• binalyze-air-get-acquisition-profile — Get acquisition profile details by ID.
• binalyze-air-get-asset — Get a Binalyze AIR endpoint/asset by asset ID.
• binalyze-air-get-asset-by-hostname — Find a Binalyze AIR endpoint/asset by hostname and organization ID.
• binalyze-air-get-asset-tasks — Get tasks associated with an endpoint/asset.
• binalyze-air-get-case — Get a Binalyze AIR case by ID.
• binalyze-air-get-case-activities — Get activity history associated with a Binalyze AIR case.
• binalyze-air-get-case-endpoints — Get endpoints associated with a Binalyze AIR case.
• binalyze-air-get-case-tasks — Get tasks associated with a Binalyze AIR case.
• binalyze-air-get-repository — Get repository details by ID.
• binalyze-air-get-task — Get task details and normalized terminal status flags for polling.
• binalyze-air-get-task-assignments — Get task assignment details for a Binalyze AIR task.
• binalyze-air-get-triage-rule — Get a triage rule by ID.
• binalyze-air-isolate — Isolate an endpoint or release endpoint isolation.
• binalyze-air-list-acquisition-profiles — List acquisition profiles.
• binalyze-air-list-assets — List Binalyze AIR endpoints/assets with optional filters.
• binalyze-air-list-cases — List Binalyze AIR cases.
• binalyze-air-list-repositories — List Binalyze AIR repositories.
• binalyze-air-list-tasks — List Binalyze AIR tasks.
• binalyze-air-list-triage-rules — List triage rules.
• binalyze-air-update-triage-rule — Update an existing triage rule.
• binalyze-air-validate-triage-rule — Validate a YARA, Sigma, or osquery triage rule before assignment.