Case Dashboard: It provides a live, case-native, and versioned single source of truth throughout the investigation lifecycle. It brings assets, findings, flags, activities, and participants into one always-available view, helping users preserve full investigation context, quickly understand case outcomes, and conduct post-incident analysis without reopening the case.
New Features & Improvements
AIR now bounds large internal evidence-table reads during import, triage, baseline comparison, and DRONE finding workflows. Large evidence tables are processed in controlled pages rather than loaded all at once.
For analysts, this improves reliability when working with large Case data and high-volume evidence sources. It reduces the risk of import or analysis instability during intensive investigations.
AIR now supports an Interrupted outcome for task assignments and parent tasks when the asset goes away during execution because of a restart, shutdown, Responder update, or service stop. The Responder still reports through the existing task-status channel, and AIR derives the clearer outcome in the Console.
Interrupted assignments are terminal, visible in task views, and retryable. Analysts can see the interruption reason next to the status and retry affected assets without treating the result as a product or task failure.
Task-completed notifications now include interrupted counts when applicable. If a task completed on some assets but was interrupted on others, AIR presents that outcome as partially completed instead of a clean success.
Task lists now support expression-based filtering, bringing the task grid in line with other advanced filtering experiences in AIR. Analysts can filter by task name, creator, type, source, status, execution type, creation time, match state, DRONE data, and rule identifiers.
Task assignment lists also support expression-based filtering. Analysts can narrow assignments by status, asset, match count, DRONE analysis identifiers, evidence availability, import status, progress, and related fields.
This is useful in active investigations where analysts need to quickly locate failed, interrupted, matched, or evidence-bearing tasks across a large operational history.
AIR’s shared data grid now uses virtual rendering for large lists where supported. Instead of rendering every row on the page at once, the grid renders the visible viewport and a buffer.
This improves responsiveness on high-volume lists such as assets, tasks, audit logs, and investigation tables. Existing selection, sorting, pagination, expansion, and row-click behavior are preserved.
Task status colors now map to semantic severity instead of using a unique color per status. Neutral states, active work, success, warning, and error outcomes now use consistent design tokens across task surfaces.
This helps analysts interpret task states faster. For example, active processing states use an information color, completed tasks use success, failed tasks use error, and partially completed or interrupted tasks use warning.
interACT v2 synchronous runs now wait up to five minutes for a command result before returning a running handle. The previous wait window was shorter and could move longer-running commands into asynchronous follow-up unnecessarily.
This improves analyst experience when running legitimate commands that need more time to complete. Commands that still exceed the window continue to use the existing running-handle behavior, and interACT v1 behavior is unchanged.
Event Subscriptions now include a Case Reopened event. Integrations can subscribe to this event to detect when a previously closed case becomes active again.
This supports case lifecycle automation. For example, an integration that configures evidence storage when a case is open can now restore that configuration when a case is reopened, not only when it is first created.
The TAXII source configuration flow now validates whether the Discovery URI returns a TAXII-compatible response. Plaintext IOC lists or non-TAXII URLs no longer appear as a successful connection.
When a reachable URL is not a valid TAXII source, AIR now provides clearer guidance and a documentation link. This helps administrators distinguish connectivity from protocol compatibility during setup.
Administrators can now configure custom Responder User-Agent values for Windows, Linux, and macOS from Settings. The configured values are applied through the Responder configuration path and take precedence when enabled.
This helps organizations with strict proxy policies keep Responder communication compliant without waiting for a new AIR release. The setting is especially useful in environments where proxies block outdated or unapproved browser-identifying headers.
The AIR API documentation has been updated with improved OpenAPI contracts, clearer examples, consistent operation metadata, and safer interactive request execution in the documentation playground.
The hosted API Docs playground can now send non-credentialed requests from the approved documentation origin. Mutation requests require confirmation, and dry-run-capable requests default to preview behavior where supported.
Console-hosted Swagger pages now use the shared Binalyze API documentation interface, including improved navigation, mobile layout, release controls, and branding consistency.
interACT now starts correctly when “Select all items” is used from the Assets page. Previously, the wizard could close without creating any sessions because select-all carried a filter instead of explicit asset rows. AIR now resolves the filter to eligible assets and keeps the wizard open with a clear message if no assets match.
interACT All tab state is cleared when the last session closes. Command results and command history from a previous run no longer appear after all sessions are closed and a new session set is opened. This also prevents exported interACT reports from including results from unrelated prior sessions.
Version Update duration now reflects Responder-reported execution time. The Version Updates grid no longer includes the time an asset spent offline before receiving the task. When the Responder reports its measured duration, AIR shows that value in the update history.
Offline license validation now bypasses the configured outbound proxy. In offline-license deployments, AIR now routes validation to the internal license service directly. This prevents setup and later license checks from failing when a corporate proxy cannot resolve internal service names.
Large-task confirmation now uses the task’s eligible asset pool. AIR now compares the selected assets against the assets the selected task type can actually target, instead of all assets in the organization. This makes the confirmation dialog appear in cases where a user selects most or all eligible assets.
Scheduled Version Update tasks are now counted under Scheduled Others. Asset detail and global task navigation no longer show scheduled Version Update tasks only in the parent Scheduled Tasks count while all child categories show zero.
The Task Info DRONE label now shows the correct state. Acquisition tasks that used a DRONE Analyzer Profile or legacy DRONE enablement no longer appear as DRONE disabled when analysis was actually enabled.
Auto-update tasks now use the Responder lane declared in the same visit. AIR now builds automatic update tasks from the lane reported by the Responder during the current visit, reducing unnecessary Console fallback downloads when CDN packages are available.
The Send to Case dropdown now stays open until the user acts. Row-level Send to Case menus open on click and remain available until the user clicks away or sends the assignment to a case.
The Actual DB Usage page no longer fails with a missing organization error. Optional organization filters are now handled correctly, including empty or omitted values, so the page can load without making the AIR session feel unresponsive.
Cancel buttons are visible in dark mode. Notification integration modals now use the correct button theme so Cancel actions remain readable in dark mode.
Investigation Hub evidence tree no longer crashes in production builds. AIR now uses a tree-shake-safe aggregation path when building the evidence tree, preventing the affected view from failing after production build optimization.
Case task APIs now return the correct interACT report URL. Public case task responses now point interACT assignments to the interACT report instead of the Investigation Hub dashboard.
Investigation Hub import failures are now reported honestly to the queue layer. Permanent import errors now fail the job after the assignment status is written, reducing cases where partial imports appeared as successful at the job level.
Task-completed notifications now match task outcomes more accurately. Notifications now include interrupted endpoint counts and classify partial outcomes consistently with task views.
On-premise outbound CIDR behavior was corrected for private validation targets. When the outbound CIDR environment setting is empty on on-premise deployments, AIR again allows private validation targets while continuing to block loopback, link-local, unspecified, and cloud-metadata addresses.
Recent activity creation is now scoped to the caller’s organizations. AIR no longer returns names or organization IDs for cases, tasks, assets, or reports outside the caller’s authorized scope through recent-activity creation.
Login session cleanup is now scoped to the logging-in user. One user exceeding the session-history cap can no longer remove session-history records for other users.
Relay and RelayPro registration now enforce tenant isolation. Relay registration now verifies that the asset belongs to the organization proven by the deployment token, and RelayPro lookups are scoped by organization.
Git repository browse-tree cache keys are now scoped correctly. Cached repository trees are separated by organization, repository, host, and credential identity, preventing cross-tenant cache collisions and stale listings.
Git repository webhook secrets are no longer returned to view-only callers. Read-only repository access no longer exposes the secret used to authenticate anonymous repository sync callbacks.
interACT command-result downloads now reject path traversal filenames. Download requests must use plain filenames, preventing access outside the intended command-result directory.
Processor proxy security checks now apply regardless of URL casing. Mixed-case processor proxy paths now pass through the same body parsing and outbound validation path as lowercase routes.
Case note write permissions are aligned between API versions. Case note create, edit, delete, and task-assignment import actions now require case management permission consistently. Case owners, note writers, and global administrators can delete notes according to the corrected rule.
All-organization shared resources have stronger mutation checks. Organization-scoped users can no longer delete or modify shared disk image acquisition profiles, interACT snippets, interACT tags, policies, or auto asset tagging rules through routes that previously missed the all-organization check.
TAXII tag filtering now avoids oversized URLs. AIR can filter triage rules by tag prefix instead of expanding nested tag trees into hundreds of individual identifiers, preventing failures in environments with large rule-tag hierarchies.
API documentation mobile navigation and sidebar spacing were improved. The documentation sidebar no longer overlaps key controls, and mobile navigation keeps the menu, title, and API controls usable on smaller screens.