AIR Release Notes

Version 3.4.3

Features

• Network Capture for Linux and macOS

  • Beginning in version 3.4, the network capture feature is available on Linux and macOS operating systems.

• Display Real IP Addresses of Endpoints by using XFF (Credits: Aaron V.)

  • AIR Console can read and parse the HTTP requests and XFF headers from the Forward Proxy and associate them with the assets to determine the assets' real IP.

• x64 support for Off-Network Microsoft Windows

  • Beginning in version 3.4, Microsoft Windows 64-bit Off-Network binary package is available and can be run on supported 64-bit architectures.

• Disk Imaging

  • Binalyze AIR provides disk imaging which we call “Acquire Image”, for Microsoft Windows, Linux, and macOS operating systems.

• The last Seen Endpoints filter parameter was added to API (Credits to Garmin)

  • “Get Endpoint” API request now has the Last Seen Endpoints filter parameter. So the assets can be listed by the last seen date.

• AIR for Chrome

  • AIR For Chrome is the evidence collector extension for Chrome and ChromeOS. AIR For Chrome extension allows investigators and analysts to capture forensically sound data with a single click at machine speed.

• The character limitation on the hostname field of the Endpoints is removed.

  • Beginning in version 3.4, there will be no character limitation for assets' hostnames. Assets that have hostnames longer than 15 characters won't be trimmed and shown as they are.

• The Endpoint Details page has been improved

  • The new endpoint details page is more organized and practical and provides more information about the asset.

  • The name of the System Resources tab has been changed to Hardware, and Volume and disk information will be shown here.

  • Acquire button function has been expanded. When it is clicked, Acquire Evidence and Acquire Image options will appear, and users can select any of them to start a data acquisition or disk/volume imaging task.

  • Disk and volume imaging, what we call Acquire Image tasks, can be performed in Volume or Disk tabs under the Hardware section of the Endpoint Details page.

Version 3.2.4

Security Hot fix

• Binalyze AIR uses the JWT library that was compromised, immediate actions have been taken to remediate and AIR v3.2.4, containing the hot-fixes for the related vulnerabilities, has been released as of today. This includes fixes for the indirect vulnerabilities due to second-level dependencies.

  Therefore, it is strongly recommended to update your existing AIR deployments to this latest version AIR v3.2.4 at your earliest convenience. 

Version 3.2.2

Features

• Activity Overview Dashboard added

  • Activity Overview Dashboard is a dynamic dashboard that provides tabular and graphical information about the usage, benefits, and return on investment of the Binalyze AIR in the enterprise company.

• Progress Monitoring was added to InterACT secure remote shell

  • Investigators can track the progress of the command and estimate how much time is left on the interACT shell

• AIR Agent Proxy Support

  • AIR agent automatically identifies the proxy configuration on the endpoint and configures itself to access the required services over the proxy service.

Enhancements

• Miscellaneous package and dependency updates

Fixes

• Several bugs fixed

Version 3.0.5

Features

• RFC-3161 compatible evidence signing for the chain of custody

Enhancements

• New Asset status, "Off-Network," added

• AIR Console domain address updates are enhanced

• New evidence types added

  • Docker Artifacts for Linux OS

  • Browser History Artifacts for Linux OS

  • Browser History Artifacts for macOS

  • RAM image collection for Linux

• Agent uninstallation and purge operations are enhanced

• Multi-file upload for Off-Network devices

• Path of the evidence files added

• Local IP addresses added to the endpoint details page

• The full disk image for macOS

Fixes

• Case activity reporting to Binalyze cloud services [credit: Nixu]

• DNS and ICMP Protocols are filtered when Endpoint Isolation

Version 2.9.3

Fixes

• Fixed an agent uninstallation issue on Linux and macOS

• Fixed an issue where in some cases, disk imaging would hang

Version 2.8.2

Features

• Added off-network Acquisition and Triage with portable agent

• Added interACT for macOS

• Added Tamper Detection for macOS agent

Enhancements

• API now includes endpoints for Policy, Auto Asset Tagging, Triage Rules, and Users (Docs)

• interACT shell now supports backslash (\) for newline

• Updated and improved the powershell deployment script

• Improved efficiency of e-Discovery and custom content collections

Fixes

• Fixed an issue where some users were not able to upload files to the interACT library

• Fixed an issue where sending the same acquisition twice to the same timeline would result in duplications

• Fixed an issue where an evidence repository that’s in use in a policy could be removed from the console

• Fixed limitation on username length

Version 2.7.1

Fix

• Fixed a bug related to agent uninstallation process

Version 2.6.1

Features

• Added asset baseline forensic comparison

• Added support for FTPS evidence repositories

• You can now have interACT sessions with isolated Windows endpoints

Enhancements

• Added new evidence and artifact types to Windows acquisition

• All active interACT sessions are now ended when interACT is disabled from settings

• Added "New Rule" shortcut to Triage assignment screen

• Added keyboard support for confirming and dismissing popups (Enter/Esc)

• Improved evidence compression performance

• Enabled option not to compress evidence on collection

• Upgraded interACT curl executable to version 7.83.1

• Upgraded interACT osquery executable to version 5.2.3

• Improved performance of agent installation on Windows

Fixes

• Improved Auto Asset Tagging task assignment

• Improved UI performance in various locations

• Improved security of sensitive credentials saved in the AIR setting

• Fixed an issue with the status of the agent update task

• Fixed a bug in the interACT zip command

• Fixed a minor bug in unique case directory creation on endpoints

• Fixed other minor bugs

Version 2.5.0

Features

• Added DRONE support for Linux

• Added Sigma rule triage to Linux

• Added shareable deployment feature

• Added new organization management page

• Added osquery command to interACT

• Added mkdir command to interACT

• Added sort and tree options to interACT pslist command

Enhancements

• Added SSL Enforcement for accessing AIR. 

• Added auto asset tag rules for Apache, Redis, Mysql and Rabbitmq

• Added tamper detection type to audit log description

• Added filtering endpoints by label

• Added filtering audit logs by endpoint name

• Added TACTICAL and DRONE KB download links

• Added required privileges section to interACT command help pages

• Improved endpoint update performance

• View and Update Organization privileges moved from system privileges to user privileges

• Hardened to prevent less-privileged users from accessing sensitive settings data

• Upgraded interACT curl executable to version 7.82.0

• Improved tamper detection 

• Improved triage to allow the same Yara rule name in different rulesets

• Added time frame limit to DRONE Event Records Analyzer

• Improved DRONE Ransomware Analyzer performance. Added total and per channel limit for Events of Interest and Event Records analyzer.

Fixes

• Fixed a minor issue on global search

• Fixed evidence repository path validation bug

• Fixed Endpoint label delete issue

• Fixed e-Discovery patterns search issue

• Fixed interACT curl command's missing CA certificates on Windows

• Fixed a bug in sigma triage to kill DRONE process when task is canceled

• Fixed an issue with the DRONE Linux x86 build.

• Fixed other minor bugs

• UI/UX improvements

Version 2.3.6

Fixes

• Fixed a bug that broke the database migration step on v2.3.5

• Fixed minor memory leak in the Events of Interest analyzer

Version 2.3.0

Blog News: v2.3.0

Features

• InterACT: A cross-platform remote shell session capability that allows the users to run commands on remote endpoints for triage, mitigation, and remediation purposes in situations such as cyber incident response activities.

Enhancements

• Improved windows agent installation

• Improved endpoint tag assignment

• Increased timeout duration for Azure Blob Storage

Fixes

• Fixed incorrect tag-endpoint count

• Fixed scheduled instant execution

• Fixed invalid SFTP port

• Fixed returning wrong http status code for invalid evidence repository Id

• Fixed organization search criteria

• Fixed timeline wrong date range issue on export

• Fixed multiple role assignment issue on UI

• Fixed showing "Reset filter" button in the timeline

• Fixed organizations tag gaps on the UI

• Fixed privilege hierarchy issue between organization and global admin roles

• Fixed not showing 404 page for case section

• Fixed webhook URLs display issue in some cases

• Fixed duplicated start date field in scheduled task detail

• Fixed no link issue on "see details" text on Settings > Connection page

• Fixed broken KB links for Webhooks and SSO

Version 2.2.0 (RC)

Features

• Added exporting endpoints as CSV

• Added exporting cases as CSV

• Added exporting case activities as CSV

• Added exporting case notes as CSV

• Added exporting case endpoints as CSV

• Added exporting audit logs as CSV

• Added exporting timeline events as CSV

• Added Yara external variables and removed yara+ modules (file, process)

• Upgraded Yara to 4.1

• Enriched triage case report for file matches for Linux

Enhancements

• Added webhook support for Elasticsearch Logstash Kibana (ELK)

• Added webhook support for SumoLogic

• Improved task queues

• Improved triage performance

• Improved handling of cancel tasks

• Improved connection timeouts

• Improved log rotation

• Improved log format

• Improved logging

• Improved Triage case report

• Updated the application icon for the Windows agent

• Added timeout for evidence repositories on agent

Fixes

• Added retry for agent HTTP requests

• Added retry for failed case file uploads

• Introduced Linux systemd service restart on failure

• Fixed compression progress reporting

• Fixed HTTP response close

• Fixed a race condition for HTTP transport

• Fixed progress reporting

• Fixed self match possibility of custom content collection for Linux

• Fixed misc. minor bugs

Version 2.1.0 (RC-2)

• Added additional functionality to cases feature

• Minor fixes and improvements

Version 2.1.0 (RC)

Version 2.0 (RC)

Version 1.8.2

Version 1.7.61

• Fixed NATS blocking call problem.

• This is the last AIR Console version that supports the MSI installer. In future releases, Docker will be the only deployment option.

Version 1.7.55

• Added ability to change the console address to migrate endpoints to a new AIR instance.

Version 1.7.45 (RC)

• New Feature: CSV import support for Timeline

• New Feature: Amazon S3 Bucket evidence repository support

• New Feature: Azure Blob Storage evidence repository support

• New Feature: LDAPS integration support

• Changed Triggers to Webhooks

• Added Sources field for Investigation

• Added support for deleting timeline resources

• Added LimaCharlie Webhook support

• Added new predefined YARA rule: NSA Mitigating Webshells

• Added name field to evidence repositories

• Improved timeline filtering

• Improved timeline performance

• Improved progress reporting based on percentage and time on Linux agent

• Improved recursive directory walk when compressing case directory on Linux agent

• Improved isolation task assignment validation

• Improved task cancellation for network share evidence repository on Windows agent

• Improved SFTP upload on Windows agent

• Fixed delay on task receiving after an agent is upgraded to a new version

• Fixed deploy script bug for non-HTTPS servers

• Fixed minor bugs on Linux agent

• Fixed an issue in YARA scanner on Windows agent

Version 1.7.40

• Blog News: v1.7.40

• New feature: AIR-QRadar integration. Now, an acquisition can be started by triggering AIR via QRadar (credits: Esra Kulüp)

• New feature: Added Roles and Privileges. Starting from this version AIR contains 70+ user privileges for more fine-grained control

• New feature: Added backup support for case reports and config files. (Database backup is already available beginning from v1.7.16)

• New feature: Added AES encryption option for backups

• New feature: Added SFTP support to store backups on the remote server

• New feature: Added performing bulk operations on the selected endpoints (adding/removing tags, deleting endpoints, starting acquisition triage, and much more. credits: Babak Mirzahosseiny)

• New feature: Added triage support to Linux. Now, the file system and memory can be scanned using YARA rules. (credits: Hilko Bengen (https://github.com/hillu/) Author of go-yara (https://github.com/hillu/go-yara))

• New feature: Added Custom Content collection from Linux distributions

• Added progress update for compression and SFTP upload process on Linux

• Added sending matched triage rules to Syslog

• Added advance filter options to data grids

• Added auto-generated shell script to facilitate Linux deb and rpm packages deployment

• Added AIR integration guideline to documentation

• Improved policy creation UI & UX

• Improved setup process UI & UX

• Improved custom SSL certificate information

• Improved task completion status UX

• Improved nats communication in agent

• Implemented more secure cookie-based authentication

• Optimized Audit logging performance

• Optimized Syslog bulk processing performance

• Fixed changing proxy settings when the license is lockdown

• Fixed an issue in the agent installer

• Fixed some security vulnerabilities

• Minor changes and bug fixes

Version 1.7.31

• Fixed the bug related to task assignment to endpoints that are associated with multiple tags

Version 1.7.24

• Fixed a critical issue on the task assignment module

Version 1.7.21

• Fixed an issue in UI

• Other minor bug fixes and improvements

Version 1.7.16 (RC)

• Added getting endpoint system resources feature

• Added database backup feature that allows admin to create database backups regularly (credits: Turkcell CDC)

• Added version column to the endpoint page

• Added two new endpoint issue types

• Added agent update management feature (credits: Turkcell CDC)

• Added capability to fix registration issue for endpoints that re-installed

• Improved error report sending on the installer

• Improved offline license check

• Improved endpoint issue filter

• Improved dashboard page statistics

• Improved automatic page data polling

• Highly improved backend and agent logs

• Improved re-upload task mechanism

• Fixed an issue on triggers that cause not to ignore recurring requests

• Fixed getting 404 when trying to download an external resource from the report

• Fixed an issue in task fail upload condition

• Fixed an exception in downloads collector

• Other minor bug fixes and improvements

Version 1.7.12 (RC)

• Highly improved Yara Scanner speed

• Improved getting agent logs from AIR

• Improved process collector

• Fixed an issue in Yara Scanner

• Fixed an issue in Prefetch collector

Version 1.7.10 (RC Sunburst Edition)

• Added FireEye Red Team Tool Countermeasures Yara Rule

• Added FireEye Mandiant SunBurst Countermeasures Yara Rule

• Added support for both filesystem and memory triage

• Added support for getting agent logs from AIR

• Added support for agent log rotating

• Highly improved AIR backend for concurrent operations

• Fixed an issue in triage results

• Fixed a minor issue in license

• Other minor bug fixes and improvements

Version 1.7.7 (RC)

• Added Log Retrieval action to endpoint

• Added Timeline action to endpoint group and endpoint tag tree

• Added Reset Password support for users

• Added scroll support for timeline

• Added downloading case entries from report

• Improved TimelineIR experience

• Fixed minor install/uninstall bugs

• Fixed trigger recurrence bug

• Fixed other minor bugs

• Removed setting AD and proxy configs from the installer

Version 1.7.4 (Beta)

• Fixed an issue in event log parser

Version 1.7.1 (Beta)

• Added TimelineIR feature

• Added Binalyze Patrol feature

• Added audit logs feature

• Added role-based access control

• Added "Acquire Evidence", "Schedule Acquisition", "Triage" and "Delete Endpoint" actions by tag

• Highly improved agent performance

• Highly improved agent memory usage

• Improved settings page to separate The Users, License, and Evidence Repositories pages

• Improved case file upload to handle .ppc files

• Improved the installer prerequisites to handle the newer version of NodeJS

• Improved debug logs

• The minimum memory requirement for the AIR server increased to 8GB

• Other minor bug fixes and improvements

Version 1.6.11

Version 1.6.8

Version 1.4.1

Version 1.3.6

Version 1.3.3

Add your timeline event here.

Add your timeline event here.