Asset status notifications improve response readiness. AIR can now notify teams when a Responder-backed asset becomes Unreachable or Unmanaged, based on preferences configured in Notification Settings. This helps analysts identify coverage gaps earlier and avoid starting response actions against assets that are no longer ready for investigation tasks.
System Resources now highlights operational risk before it affects investigations. On-premise deployments now have a redesigned System Resources view with CPU, memory, and disk cards, plus an application-wide low-disk warning. This helps administrators detect capacity issues before evidence collection, analysis, or reporting workflows are impacted.
Several Investigation Hub import paths have been strengthened to preserve evidence consistency during concurrent or retried imports. AIR now handles overlapping case and task-assignment imports more safely, isolates temporary evidence databases per import, and avoids shared-state races during DRONE result ingestion.
These improvements reduce the risk of missing findings, duplicated imported rows, inflated counters, or incomplete evidence visibility after interruptions. For analysts, this means Investigation Hub results are more dependable during large investigations or when the same task data is opened from more than one workflow.
DRONE findings and DRONE analysis imports now coordinate more safely when both write results for the same task assignment. AIR also recovers analysis rows that could previously be removed by a concurrent cleanup path, improving confidence that automated findings remain available after import completion.
The default Memory Limit for responder tasks is now 4 GiB. Previously, a missing memory configuration meant unlimited memory usage. The new default limits the resource exposure of task execution while preserving the option to set unlimited memory deliberately.
The 4 GiB default appears in task customization, policy configuration, and interACT shell task options. The Default Policy also converges to 4 GiB during upgrade, so new tasks that follow the Default Policy inherit the safer limit automatically.
Entering 0 or clearing the Memory Limit field still means unlimited. Existing custom policies keep their stored values, including explicit unlimited values. This allows administrators to keep intentionally configured exceptions while improving the default posture for the broader fleet.
Integration users should note that task callers that omit a memory value now receive the 4 GiB resolved default. To restore unlimited behavior for those callers, create a higher-priority custom policy with Memory Limit cleared or set to 0.
AIR now ships two Linux Responder packages so both older and modern Linux assets stay supported:
Legacy — for Linux kernel 2.6.32 and above. Use this on older distributions.
Edge — for Linux kernel 3.2 and above. Use this on modern distributions.
These kernel ranges follow the Go runtime used to build each package. The Edge package is built with Go 1.26, which requires Linux kernel 3.2 or newer. The Legacy package keeps support for older kernels that cannot run that runtime.
When a Linux Responder is downloaded or deployed, the package that matches the asset’s kernel should be chosen. For assets already managed by AIR, later updates use the matching package automatically.
What happens to existing Linux assets: AIR does not yet know which package an already-installed Linux Responder should use. Those assets therefore receive the Legacy package on their first update after this change. After that update, AIR can match the asset’s kernel: hosts running kernel 3.2 or newer move to the Edge package on the next update. Older kernels stay on Legacy.
AIR can now retrieve validated User-Agent records from the Responder CDN and deliver the appropriate value to responders through the existing configuration flow. This allows User-Agent values to be updated without requiring a responder release.
The Console periodically refreshes the record set, validates freshness and format, stores the accepted version locally, and recalculates configuration tags only for affected assets. This keeps responder configuration changes targeted and avoids unnecessary updates across unaffected platforms.
This improvement helps administrators respond faster when endpoint security controls require updated User-Agent strings for responder communication.
Deployment commands now validate TLS certificates by default. For on-premise environments that use self-signed or private certificates, authenticated administrators can explicitly choose the insecure copy option where available, or pass the documented script flag manually.
This change improves the default security posture of responder deployment while preserving an operational escape hatch for controlled on-premise environments. SaaS and shareable deployment links do not offer the TLS bypass option.
AIR now generates notifications when responder-backed assets become Unreachable or Unmanaged, based on preferences configured in Notification Settings. Notifications can be delivered through in-app, email, Slack, Teams, and Mattermost channels according to the customer’s notification configuration.
These alerts help analysts and administrators detect asset availability or management changes before starting collection or response tasks. For example, if an asset becomes Unreachable, teams can address connectivity or responder readiness before relying on that asset for evidence collection.
Notifications are deduplicated by asset and state transition so repeated scans do not create excessive noise for the same condition.
The System Resources page has been redesigned for on-premise deployments. It now presents CPU, memory, and disk utilization as cards with warning and critical states.
When the application and database use separate hosts, AIR can show separate disk cards for each. If disk usage becomes high, a warning bar appears at the top of the application and links directly to System Resources for review.
Administrators can snooze or dismiss the warning. If severity increases, AIR shows the warning again so teams do not miss a worsening storage condition. This is especially important for investigation environments where disk pressure can affect evidence ingestion, storage, and reporting.
interACT now handles asset selections more consistently across the Assets page, case assets, endpoint details, and the Quick Start wizard. When a selection starts from a filtered asset list, AIR hydrates the selected asset details so session tabs show the correct asset name, platform, and IP address.
When analysts use Select all items from the Assets page, interACT now resolves the matching eligible assets before starting sessions instead of closing the wizard without creating sessions. AIR also respects the session limit and remains on the wizard if no eligible asset remains.
The interACT All tab now clears command results and command history when all sessions are closed. This prevents stale output from appearing in a later, unrelated session set or being included in exported reports.
SMTP username and password fields are now optional. Customers that use internal SMTP relays or unauthenticated SMTP servers can configure email delivery without supplying credentials.
When credentials are configured, the UI clearly indicates whether a saved password exists. Administrators can keep the stored password, update it, or clear it explicitly. If the username is empty, AIR does not send SMTP authentication details.
Repository Explorer access is now aligned with Evidence Repository view permission. Users who can view evidence repositories can browse and download through Repository Explorer without also requiring cloud asset account visibility.
Disk image import remains gated by the appropriate asset-creation permission and requires a resolved account context. This improves least-privilege access for teams that need to review repository content without managing cloud asset accounts.
interACT sessions started from asset selections now show asset names correctly. Sessions opened from bulk selection, endpoint details, or case assets previously showed blank tabs, missing platform icons, empty IP values, and “Unknown Session” in command results. AIR now hydrates selected asset details before creating sessions.
interACT Select all items now starts sessions instead of silently closing. When analysts selected all filtered assets and clicked Connect, no request was sent and no session was created. AIR now resolves the filter to eligible assets, respects exclusions and limits, and keeps the analyst in the wizard if nothing can be started.
interACT All tab no longer carries results into a new session set. Command results and command history are cleared when the final session is closed, preventing stale output from appearing in a later session or in exported reports.
interACT WebSocket authorization now enforces session ownership. The Console now verifies that the connecting user owns the requested interACT session and that the connection asset matches the session asset. This aligns WebSocket behavior with the REST session guard.
Responder update actions now respect asset eligibility. AIR no longer enables Update Responder Version when all selected assets are excluded from updates, in maintenance mode, or already ineligible. Asset detail pages also no longer offer manual updates for assets manually excluded from updates.
Stale version-update badges are cleared more reliably. Assets no longer continue to show Waiting or Scheduled after auto-update is disabled or when an update policy blocks the asset. Manual exclusion also clears stale lifecycle status.
Linux responder updates now use the lane declared during the same poll. AIR no longer builds an automatic update task from stale lane data loaded before the current heartbeat or visit. This prevents assets from being offered the wrong Linux package on the first lane-aware update.
Deploy Responder for cloud assets now targets only the selected asset. A selection containing one AWS cloud asset could previously trigger deployment for multiple devices. AIR now resolves expression filters correctly and intersects them with the selected asset list.
Isolation task failures no longer leave assets stuck in Isolating or Unisolating. When an isolation task fails, AIR now reverts the asset state so analysts can retry or initiate the appropriate follow-up action.
Repository Explorer browse now works for view-only evidence repository roles. Users with Evidence Repository view permission can browse repository content even if they do not have cloud asset account visibility. Import actions remain controlled by the required asset permissions.
Cloud Sync Failed notifications are now readable. Notification bodies no longer display raw JSON or literal newline characters. AIR now renders a clean, single-line message in the header popover and notification history.
On-premise Global Search no longer exposes the SaaS-only Update settings page. Deployment-model route metadata is now applied consistently, so SaaS-only settings do not appear in on-premise search results or direct navigation paths.
Investigation Hub DRONE imports no longer race on shared temporary database files. Each DRONE import now uses an isolated temporary path, preventing concurrent imports of the same task assignment from corrupting or deleting each other’s input.
Investigation Hub Case.db ingest is safe under concurrent case and task-assignment imports. AIR now avoids shared SQLite data-source state that could delete another in-progress import’s database and produce empty or missing evidence tables.
DRONE import cleanup now releases temporary files and archive handles on all paths. Malformed or incomplete archives no longer leave open handles or temporary files behind, reducing the risk of storage and file-handle exhaustion during repeated retries.
DRONE findings and DRONE analysis imports no longer delete each other’s rows. AIR now serializes the overlapping write paths and co-enqueues recovery when needed, reducing the risk of silent finding loss after retries or concurrent imports.
External evidence import retries no longer duplicate rows or counters. Retried imports now clean up prior rows for the same import before re-inserting and recompute counters from stored data instead of incrementing stale values.
Tornado evidence import retries are now idempotent. AIR now creates the assignment before marking the import completed or deleting upload records, preventing unrecoverable retries and duplicate imported evidence.
Investigation Hub migration-wait retries no longer create duplicate delayed import jobs. AIR now delays the current job instead of adding new jobs with random identifiers while a migration is active.
Refactored osquery ingestion now builds valid evidence queries. Triage and acquisition assignments containing osquery results no longer fail with SQL syntax errors when the refactored ingestion path is enabled.
Malformed PST and imported-data feeds now return controlled validation errors. Empty, truncated, or wrong-format inputs no longer fall through to generic internal errors in the evidence import pipeline.
Imported-evidence task assignment lookup now uses parameterized values. AIR fixed a blind SQL injection path in the Investigation Hub imported-evidence lookup. Unmatched import IDs now return a controlled not-found response instead of an internal error.
Fleet-action filters now honor legacy includedIds and excludedIds fields. Requests that explicitly target a non-existent asset ID now fail closed instead of widening to every managed asset in the organization.
Evidence repository validation now requires repository management privileges. View-only users can no longer use validation routes as outbound connection tests. This better aligns connection validation with repository create and update permissions.
On-premise outbound validation now blocks private network ranges by default. Repository and related outbound connection tests now reject RFC1918 private destinations unless administrators explicitly allow the required internal ranges. Customers using private evidence repositories should configure the allowed outbound CIDR ranges before validating those repositories.
Cross-organization Git repository browsing has been blocked. AIR now applies organization-scope checks when browsing repository trees or listing branches from stored repository connections.
SSO provider management now requires Global Admin authority. Users with settings-save privileges but without Global Admin authority can no longer create or modify SSO providers. This protects the trust boundary around identity provider configuration.
Organization admins can no longer reset Global Admin 2FA. AIR now applies the same target-tier protection to reset 2FA that already existed on neighboring user-management actions.
Stored XSS paths were closed across several user-controlled fields. AIR now validates or escapes case names, endpoint hostnames, Full Text Search profile keywords, and Slack channel names before they can execute in notification panels, profile editors, or routing dialogs.
OpenAPI documents are no longer anonymously exposed. Swagger JSON and YAML documents are now served through authenticated API paths, and legacy public paths redirect to the protected routes.
Cloud account sync and GCP-related notification rendering was improved. Cloud Sync Failed messages now display in a user-readable format and no longer expose raw object payloads in the notification UI.
Quick Start image evidence privilege tests and related UI behavior were stabilized. The UI now asserts the correct access contract by disabling the parent action rather than relying on hidden nested menu content.