<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=3026858&amp;fmt=gif">

Triage

Remote Triage at Scale

Move seamlessly from forensic evidence acquisition findings to rapid Triage across your network directly from the AIR management console.

remote triage

Search with YARA

Create or import YARA rules within the AIR platform and share them between analysts. Triage tasks can be sent to an endpoint in seconds to scan both memory and file system.

Rule Builder & Validator

AIR’s YARA rule builder and validation features make YARA rule creation and management efficient and error-free.

Fast, Concurrent Scanning

From the AIR management console Triage can be performed remotely and at scale across multiple endpoints concurrently.

CPU Usage Limitation

For complex triage on high availability machines, or where the corporate policies dictate, AIR allows you to limit the amount of CPU usage.

When a Triage rule match is detected on the endpoint why wait to take action?

Our proprietary Auto Actions and interACT technology allow the remediation process to begin automatically to prevent unnecessary delays that extend the threat window, while also removing laborious and time consuming manual tasks.

* Coming Q4 2021

Define the following actions from directly within your YARA rules.

  • Isolate the machine
  • Acquire evidence
  • Create a timeline
  • Dump a process
  • Delete a file
  • Run a command (interACT)
  • Reboot
  • Shut down
Download the AIR Features Guide
It only takes 2 mins to setup your free AIR trial
Providing Cyber Resilience to World-class Enterprises Globally
PwC Garmin Sophos Turkish Airlines KPMG EY Deloitte Turkcell Integrity360