Binalyze AIR Extended
Overview
Binalyze AIR Extended is a Cortex XSOAR integration designed to orchestrate Binalyze AIR incident response and forensic operations directly from Cortex XSOAR playbooks, automations, and the War Room.
The integration extends the baseline Binalyze AIR action set with operational commands for endpoint isolation, forensic acquisition, case management, triage rule lifecycle, task polling, asset lookup, acquisition profile discovery, repository visibility, and evidence artifact download.
This build is intended for SOC, DFIR, threat hunting, malware investigation, and detection engineering workflows where Cortex XSOAR acts as the orchestration layer and Binalyze AIR performs endpoint-level forensic and response actions.
What does this pack do?
- Isolate or release endpoint isolation.
- Start forensic acquisition tasks using predefined or custom acquisition profiles.
- Create, get, list, close, and query Binalyze AIR cases.
- Look up assets/endpoints before taking response actions.
- Poll task status and task assignments for GenericPolling-compatible playbooks.
- Create, validate, update, list, get, delete, and assign triage rules.
- Run YARA, Sigma, and osquery-based triage tasks.
- List and inspect acquisition profiles.
- List and inspect repositories.
- Download files from the Binalyze AIR InterACT library into the Cortex XSOAR War Room.
Supported Use Cases
Incident Response
Use the integration to collect endpoint evidence, isolate compromised systems, and associate forensic tasks with a Binalyze AIR case linked to a Cortex XSOAR incident.
Malware Investigation
Run memory, event log, browser artifact, quick, full, or compromise-assessment acquisitions from a playbook. Use YARA rules to hunt for malware indicators across selected endpoints.
Threat Hunting
Create and validate temporary or persistent triage rules, assign them to endpoints or endpoint groups, and use task polling to track execution state.
Detection Engineering
Push detection hypotheses from Cortex XSOAR into Binalyze AIR as Sigma, YARA, or osquery triage rules. Validate rule syntax before assignment and store results in Cortex XSOAR context.
Configure Binalyze AIR Extended in Cortex XSOAR
| Parameter | Description | Required |
|---|---|---|
| Binalyze AIR Server URL | The Binalyze AIR Server URL, for example https://air.example.com. | True |
| API Key | The Binalyze AIR API token, for example api_1234567890abcdef1234567890abcdef. | True |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
This README should be regenerated with demisto-sdk generate-docs by using the included command_examples.txt file. The manual overview above is intentionally concise and the command reference should be generated by the SDK to include the mandatory command example, context example, and human readable output sections.
GenericPolling Guidance
Use binalyze-air-get-task as the polling command for acquisition and triage tasks. The command exposes BinalyzeAIR.Task.IsDone and BinalyzeAIR.Task.IsSuccess for playbook decision logic.
Notes
Extended endpoint paths may vary by Binalyze AIR version. Validate exact path behavior in your own Binalyze AIR environment before production rollout.