commonfields:
  id: Binalyze AIR
  version: -1
name: Binalyze AIR
display: Binalyze AIR
category: Forensics & Malware Analysis
provider: Binalyze
description: Collect your forensics data under 10 minutes.
configuration:
- display: Binalyze AIR Server URL
  name: server
  type: 0
  required: true
  additionalinfo: Binalyze AIR Server URL
- display: API Key
  name: api_key
  type: 4
  required: true
  additionalinfo: 'e.g.: api_1234567890abcdef1234567890abcdef'
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: python
  commands:
  - name: binalyze-air-isolate
    arguments:
    - name: hostname
      required: true
      description: Hostname of endpoint.
    - name: organization_id
      required: true
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      description: Organization ID of the endpoint. For a custom organization ID, you can specify a custom value outside the predefined set.
    - name: isolation
      required: true
      auto: PREDEFINED
      predefined:
      - enable
      - disable
      description: To isolate use enable.
    outputs:
    - contextPath: BinalyzeAIR.Isolate.result._id
      description: Isolation unique task ID.
      type: string
    - contextPath: BinalyzeAIR.Isolate.result.name
      description: Isolation task name.
      type: string
    - contextPath: BinalyzeAIR.Isolate.result.organizationId
      description: Organization Id of endpoint.
      type: number
    description: Isolate an endpoint.
  - name: binalyze-air-acquire
    arguments:
    - name: hostname
      required: true
      description: Hostname of endpoint.
    - name: profile
      required: true
      auto: PREDEFINED
      predefined:
      - compromise-assessment
      - browsing-history
      - event-logs
      - memory-ram-pagefile
      - quick
      - full
      description: Acquisition profile. To use a custom acquisition profile, you can specify a custom profile outside the predefined set.
    - name: case_id
      required: true
      description: ID for the case,e.g. C-2022-0001.
    - name: organization_id
      required: true
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      description: Organization ID of the endpoint. For a custom organization ID, you can specify a custom value outside the predefined set.
    outputs:
    - contextPath: BinalyzeAIR.Acquire.result._id
      description: Acquisition unique task ID.
      type: string
    - contextPath: BinalyzeAIR.Acquire.result.name
      description: Acquisition task name.
      type: string
    - contextPath: BinalyzeAIR.Acquire.result.organizationId
      description: Organization Id of endpoint.
      type: number
    description: Acquire evidence from an endpoint.
  dockerimage: demisto/python3:3.12.13.10116658
  subtype: python3
fromversion: 6.2.0
tests:
- No tests (auto formatted)