Large upload workflows are more reliable in SaaS and browser-based workflows. Multipart and asynchronous commit flows improve large PPC imports and interACT Library uploads. AIR now validates supported upload limits earlier, reducing browser instability and preventing long commit requests from timing out while the server continues processing.
DRONE Analyzer Profile behavior is clearer and more compatible. AIR improves DRONE Analyzer Profile handling for mixed Responder versions, shows accurate MITRE ATT&CK status in Task Details, and adds clearer notices for online and Off-Network workflows. Analysts can better understand which analysis profile was used and when older Responders require fallback behavior.
Responder deployment workflows now respect relay-based share links. Shareable deployment links can preserve the selected Relay Server or RelayPro route, helping administrators deploy Responders into relay-only networks without accidentally distributing a Direct installer.
Organization dashboard design is improved. It includes case, task, asset, activity, and Investigation Hub usage summaries, with privilege-aware links into the related product areas.
Investigation Hub bulk evidence inserts have been optimized to reduce unnecessary returned data and improve database write performance for large evidence tables. AIR also uses more efficient paging for SQLite evidence tables that have an integer primary key.
These changes reduce import time and resource usage when analysts work with large acquisitions, DRONE outputs, and imported evidence sources. The result is faster access to parsed evidence and findings in large cases.
Large SQLite evidence imports now run outside the main Console event loop. This prevents long-running imports from making the Console unresponsive and reduces the risk of repeated restarts during large full-disk or Off-Network evidence imports.
For SaaS environments, AIR can also protect tasks running Off-Network Investigation Hub imports from scale-in for a bounded period. This reduces the chance that a running import is stopped by infrastructure scaling before it completes.
Investigation Hub CSV exports now stream through short database fetch batches instead of keeping one long-running statement open for the entire download. This improves reliability for large exports and helps prevent stalls caused by statement timeouts during slow downloads.
Findings and Flags exports also benefit from query-plan improvements for large finding datasets. These changes help analysts export large investigation results without hitting proxy idle timeouts as frequently.
Closing a case now reclaims investigation database space more effectively while preserving imported evidence that must remain available after reopen. Archiving a case removes investigation evidence tables because archived cases cannot be reopened.
AIR recalculates disk usage after cleanup so the case and dashboard usage values update without waiting for the scheduled statistics job. This gives administrators a more accurate view of storage consumption after case lifecycle actions.
Imported evidence remains visible after closing and reopening a case. AIR now preserves imported-evidence task assignment status during close and restores it on reopen when needed.
This prevents analysts from losing access to imported evidence rows after a case lifecycle change and keeps Investigation Hub views consistent with the data retained in the investigation database.
PPC imports and interACT Library multipart uploads now commit asynchronously. The commit request validates and queues the work, then the UI polls for status. This avoids long synchronous requests that can exceed SaaS proxy timeouts while the server continues processing.
For analysts importing large Off-Network packages or uploading large interACT Library files, the UI now reflects the actual server-side outcome more reliably and reduces duplicate retries caused by browser-visible timeouts.
When a task uses a DRONE Analyzer Profile, AIR now resolves legacy DRONE and MITRE fields for older Responders that do not understand the profile payload. Supported Responders continue using the profile path, while older Responders receive compatible legacy configuration where possible.
This helps teams roll out DRONE Analyzer Profiles while some assets still run older Responders. Analysts get more consistent DRONE and MITRE ATT&CK behavior across mixed environments.
Task Details now shows MITRE ATT&CK Analyzer as enabled when a profile-backed Hunt/Triage task includes the MITRE ATT&CK analyzer. This corrects the information shown for profile-based tasks while preserving the legacy status path.
Analysts can now trust the Information tab when reviewing whether MITRE ATT&CK analysis was part of a Hunt/Triage task.
The DRONE Analyzer Profile picker now shows separate notices for Off-Network tasks. Online tasks explain Responder version fallback behavior, while Off-Network tasks explain that the package itself must include a supported Responder version.
This helps analysts avoid creating Off-Network packages that cannot process the selected profile and makes requirements clearer before evidence is collected.
AIR adds parsed Windows Search evidence and browser preference artifact sources to acquisition catalogs. Windows Search parsed data is added alongside raw Windows Index Search in the appropriate predefined profiles, and browser preference sources are available across Windows, Linux, and macOS catalogs where supported.
These additions expand visibility into user activity and browser configuration artifacts that can support post-incident investigation and activity reconstruction.
Administrators can configure how long newly generated manual uninstall codes remain valid. The default remains 30 days when no value has been saved, and supported values are whole days within the configured range.
Generate New Code and Revoke All Codes are disabled while the setting has unsaved changes so codes are always signed with the saved lifetime.
The Dashboard has been redesigned to show operational status for the selected organization. It includes case, task, asset, activity, and Investigation Hub usage summaries, with privilege-aware links into the related product areas.
For analysts and administrators, this provides a faster way to understand current investigation activity, task health, and asset state after switching organizations.
Shareable deployment links now preserve the selected Relay Server or RelayPro route. When a relay route is selected on the Deploy New Assets flow, AIR appends the relay identifier to the share link and validates it on the shareable deployment page.
This prevents relay-only environments from receiving Direct installers by mistake. The Console validates the deployment token before resolving relay details and only returns relay routing fields when the relay belongs to the token’s organization.
Presigned task-result upload URLs now use a transfer-time-based lifetime instead of a fixed short lifetime. AIR also adds an endpoint that lets Responders refresh an individual multipart part URL if it expires during a large upload.
This improves reliability for large evidence uploads over slow links while keeping each presigned URL bound to a specific object key, part size, and checksum.
Manual multi-asset Responder updates now drain queued update work per reporting asset instead of removing the shared update task from every targeted asset when the first asset reports a terminal status.
This prevents assets that were offline, in maintenance mode, or waiting for the concurrent update limit from staying assigned forever without receiving the update.
TAXII Feed and Git Repository events are now registered so they appear in audit-log and syslog event-type filters when those events are published.
This improves filtering and downstream monitoring for teams that rely on external event forwarding and audit review.
Bull queue consumption is now held until Console bootstrap completes and stopped during shutdown. This prevents jobs from running before feature flags and license-derived defaults are ready, and reduces failures during scale-out, scale-in, and shutdown events.
For administrators, this improves automation and scheduled-task reliability during deployments and infrastructure events.
Case Dashboard disk usage and case card disk usage now use the same catalog-based estimate. This reduces confusion caused by two screens using different database-size calculations for the same case.
The estimate can still lag until database statistics are refreshed, but the UI now uses a consistent source for the values shown to users.
Investigation Hub exports are more reliable for large cases. Large Findings, Flags, Triage, and closure CSV exports no longer rely on one long-running statement for the whole download. AIR also improves query planning for large finding datasets and makes export failures visible instead of leaving downloads stalled.
Large Investigation Hub imports no longer block the Console. Long SQLite evidence imports now avoid starving the Console process, reducing 502 errors, repeated restarts, and stuck import states during large evidence processing.
SaaS scale-in protection reduces interrupted Off-Network imports. AIR can protect the ECS task running an Off-Network Investigation Hub import for a bounded period, reducing the risk of scale-in stopping a running import and forcing it to restart.
Manual Responder updates no longer strand assets in Assigned. When a manual update targets multiple assets, a terminal report from one asset no longer removes the shared update task from every other asset’s queue.
Scheduled tasks using asset time zones now match the correct assets. AIR restores correct matching for affected time offsets, including UTC+3, when scheduling tasks with Use asset’s timezone.
Invalid weekly schedule values no longer stop worker startup. AIR validates weekly day values and skips already-stored invalid rows during bootstrap instead of failing the worker health check.
Task queues no longer consume jobs before bootstrap completes. This prevents feature flags from resolving to default values during early worker startup and reduces false feature-disabled automation failures.
Investigation Hub process tree timestamps now render correctly. Timestamp columns in the process tree now show formatted date and time values instead of the literal template marker text.
Investigation Hub partial CSV/PST import warnings now show meaningful text. Warning and error toasts now display row counts and links correctly instead of rendering empty notifications.
Custom Evidence Collection Naming invalid-character warnings now display correctly. AIR now shows the warning message when invalid characters are removed from naming inputs.
Case disk usage labels now use consistent values across case views. AIR aligns Case Dashboard and case card disk usage calculations to reduce inconsistent totals for the same case.
Investigation Hub migration cleanup prevents orphaned trigger failures. AIR removes orphaned triggers that could cause backup failures after a migration race condition.
Startup import recovery no longer fails when the investigation database connection map is not ready. On startup, AIR can use the injected investigation database connection before the in-memory map finishes initialization.
interACT Library and Off-Network PPC uploads enforce the 4 GiB limit earlier. Oversized files are rejected before the browser enters an unstable upload state, and server-side multipart checks enforce the same limit for the relevant flows.
PPC and interACT Library multipart commits no longer time out as synchronous requests. Large multipart commits now run asynchronously with status polling, preventing the UI from reporting a proxy timeout while the server continues importing.
Off-Network package downloads no longer stall when sources are idle. AIR opens each package source only when the archive is ready to read it, reducing idle socket timeouts during package assembly.
Responder share links now respect selected Relay Server routes. Shareable deployment links can now include the selected relay route, preventing Direct installers from being served in relay-only deployment scenarios.
DRONE defaults schema warnings are now bounded. AIR summarizes schema validation failures instead of writing multi-megabyte warnings to the Console log.
Local development startup and shutdown behavior is cleaner. AIR avoids duplicate API boots in watch mode, logs shutdown completion after hooks finish, and improves early UI error logging during development.
Windows acquisition failures related to unsupported process job assignment were addressed. AIR improves handling for cases where Tactical cannot assign a process to a memory-policy job object on Windows.
Investigation Hub note, flag, finding, and import write operations now require stronger case permissions. Users and API tokens with read-only task access can still view investigations but cannot create or modify evidence notes, flags, findings, imported sections, or import rows without Manage Case permission.
CSV formula values are neutralized in closure exports. AIR now defangs formula-like values in closure CSV export paths so spreadsheet tools treat them as text rather than executable formulas.
Investigation Hub SQL query guard has been hardened. AIR now correctly handles dollar signs inside SQL aliases when enforcing single-statement, read-only query behavior.
Investigation Hub import sessions are bound to their create-section flow. AIR now verifies that import-data requests match a registered import session before queuing the import.
interACT session output integrity has been hardened. UI WebSocket connections can no longer send Responder-style output frames into another operator’s live interACT session.
Off-Network ZIP password responses are masked by default on legacy routes. Full passwords are returned only when explicitly requested, aligning legacy behavior with newer API behavior.
Audit log credential redaction is consistent across legacy read and export paths. AIR now redacts sensitive fields such as deployment tokens and storage access URLs in legacy audit-log list and CSV export responses.
Organization creation validation is consistent across API versions. AIR applies the same safe-name validation on newer organization creation routes and escapes organization names in Management Console labels.
Organization list responses no longer expose deployment enrollment tokens to roles that should not view organizations. AIR now requires appropriate organization-view permission and omits enrollment secrets from list responses.
Organization user lists now minimize security posture data for view-only callers. Users with only view access receive a reduced projection, while administrative callers still receive the fields needed for user management.
Logout now invalidates refresh sessions. Logging out clears refresh sessions for the user so a captured refresh token cannot continue minting new access tokens after logout.
License serial exposure has been reduced. AIR no longer logs the full license serial and replaces it with a fingerprint where correlation is needed.
AI Assistant license-key exposure paths have been hardened. Browser-side checks no longer send the Console license key to external services, and gateway error responses avoid returning raw upstream bodies.
Evidence repository credential access is better scoped. AIR validates repository organization scope for task save/send destinations and processor proxy credential merge paths, preventing organization-scoped users from receiving credentials outside their authorized scope.
Null-organization asset accounts now require all-organization access for delete and sync. AIR protects shared all-organization asset accounts from organization-scoped deletion or synchronization.
API-created scheduled tasks re-check the creating API token at fire time. Scheduled public API tasks now validate that the original token still exists and has the required organization scope and assignment privilege before dispatching work.
Bulk cancel from Danger Zone is now restricted to Global Admins. The destructive Cancel all tasks action requires Global Admin access in addition to the cancel privilege.
Event subscription privilege assignment now warns about sensitive payloads. Role editors show a warning when create or update event-subscription privileges are selected because those privileges can route sensitive deployment-token events to webhooks.
Presigned upload completion is idempotent for duplicate completion calls. AIR avoids publishing duplicate Investigation Hub events for the same completed presigned upload when the same checksum is reported again.
Large browser-based uploads now clean up more safely. Multipart upload discard and cleanup behavior has been improved so abandoned parts are removed and finalized uploads are not deleted while being committed.