Binalyze AIR
The Binalyze AIR connector allows for automated forensic data acquisition and management directly from within the Swimlane platform.
Binalyze AIR is a comprehensive digital forensics platform that simplifies the acquisition and analysis of digital evidence across various operating systems. This connector enables Swimlane Turbine users to automate the creation of acquisition profiles, trigger evidence collection tasks, and initiate evidence collection on specific endpoints. By integrating with Binalyze AIR, security teams can streamline their digital forensics processes, reduce response times, and ensure consistent evidence handling within the Swimlane Turbine platform.
Limitations
None to date.
Supported Versions
This Binalyze AIR connector uses the latest Version API.
Additional Docs
Configuration
Prerequisites
Before utilizing the Binalyze AIR connector within Swimlane, ensure you have the following prerequisites:
- HTTP Bearer Token Authentication with the following parameters:
- URL: The endpoint URL for the Binalyze AIR API.
- Token: A valid bearer token to authenticate API requests.
Authentication Methods
Bearer Token Authentication:
- URL: The endpoint URL for the Binalyze AIR API.
- Access Token: A valid Token to authenticate API requests.
Capabilities
This Binalyze AIR Connector provides the following capabilities:
- Create an Acquisition Profile
- Trigger Collection Based on Acquisition Profile
- Trigger Evidence Collection on Target Endpoint
Create an Acquisition Profile
Create a new Acquisition Profile in Binalyze AIR. permission needed: create-acquisition-profile.
Binalyze AIR's documentation for this action can be found here.
Trigger Collection Based on Acquisition Profile
Assigns an Evidence Acquisition Task using specified Filters.
Binalyze AIR's documentation for this action can be found here.
Trigger Evidence Collection on Target Endpoint
Retrieve the Task Report for a specific Endpoint.
Binalyze AIR's documentation for this action can be found here.
Configurations
Binalyze AIR HTTP Bearer Authentication
Authenticates using bearer token.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token | The API token. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Create an Acquisition Profile
Create a new Acquisition Profile in Binalyze AIR using the provided JSON body data.
Endpoint
- URL: /api/public/acquisitions/profiles
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
name | string | Optional | Name of the Acquisition Profile. |
organizationIds | array | Optional | List of Organization IDs. |
windows | object | Optional | Configuration for Windows Systems. |
windows.evidenceList | array | Optional | List of Evidence Types for Windows. |
windows.artifactList | array | Optional | List of Artifacts for Windows. |
windows.customContentProfiles | array | Optional | Custom Content Profiles for Windows. |
windows.networkCapture | object | Optional | Network Capture Settings for Windows. |
windows.networkCapture.enabled | boolean | Optional | Enable or disable Network Capture. |
windows.networkCapture.duration | number | Optional | Duration of Network Capture in Seconds. |
windows.networkCapture.pcap | object | Optional | PCAP Settings for Network Capture. |
windows.networkCapture.pcap.enabled | boolean | Optional | Enable or disable PCAP Capture. |
windows.networkCapture.networkFlow | object | Optional | Network flow Settings for Capture. |
windows.networkCapture.networkFlow.enabled | boolean | Optional | Enable or disable Network Flow Capture. |
linux | object | Optional | Configuration for Linux Systems. |
linux.evidenceList | array | Optional | List of Evidence Types for Linux. |
linux.artifactList | array | Optional | List of Artifacts for Linux. |
linux.customContentProfiles | array | Optional | Custom Content Profiles for Linux. |
linux.networkCapture | object | Optional | Network Capture Settings for Linux. |
linux.networkCapture.enabled | boolean | Optional | Enable or disable Network Capture. |
linux.networkCapture.duration | number | Optional | Duration of Network Capture in Seconds. |
linux.networkCapture.pcap | object | Optional | PCAP Settings for Network Capture. |
linux.networkCapture.pcap.enabled | boolean | Optional | Enable or disable PCAP Capture. |
linux.networkCapture.networkFlow | object | Optional | Network flow Settings for Capture. |
linux.networkCapture.networkFlow.enabled | boolean | Optional | Enable or disable Network Flow Capture. |
macos | object | Optional | Configuration for MacOS Systems. |
Input Example
{"json_body":{"name":"Sample Acquisition Profile","organizationIds":[0],"windows":{"evidenceList":["clp"],"artifactList":["apcl"],"customContentProfiles":[],"networkCapture":{"enabled":true,"duration":600,"pcap":{"enabled":true},"networkFlow":{"enabled":true}}},"linux":{"evidenceList":["syscntrls"],"artifactList":["apcl"],"customContentProfiles":[],"networkCapture":{"enabled":false,"duration":600,"pcap":{"enabled":false},"networkFlow":{"enabled":false}}},"macos":{"evidenceList":["autoproc"],"artifactList":["apcl"],"customContentProfiles":[],"networkCapture":{"enabled":false,"duration":600,"pcap":{"enabled":false},"networkFlow":{"enabled":false}}},"aix":{"evidenceList":["cronj"],"artifactList":["myl"],"customContentProfiles":[]},"eDiscovery":{"patterns":[{"pattern":"**/*.7z","category":"Archives"}]}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
result | object | Result of the operation |
statusCode | number | Status value |
errors | array | Error message if any |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Fri, 24 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"success":true,"result":null,"statusCode":200,"errors":[]}}
Trigger Collection Based on Acquisition Profile
Initiates an evidence collection task in Binalyze AIR using a specified acquisition profile and drone configuration.
Endpoint
- URL: /api/public/acquisitions/acquire
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
caseId | string | Optional | Optional Case Identifier. |
droneConfig | object | Optional | Configuration for the Drone. |
droneConfig.autoPilot | boolean | Required | Enable or disable Auto Pilot. |
droneConfig.enabled | boolean | Required | Enable or disable Drone. |
droneConfig.analyzers | array | Required | List of Analyzers to use. Valid values - /api/public/params/drone/analyzers. |
droneConfig.keywords | array | Optional | Optional List of Keywords. |
taskConfig | object | Optional | Configuration for the Task. |
taskConfig.choice | string | Required | Task Configuration Choice. Valid values are use-policy, use-custom-options. |
taskConfig.diskSpace | object | Optional | Parameter for Trigger Collection Based on Acquisition Profile |
taskConfig.diskSpace.reserve | number | Optional | The value is expressed in bytes. |
taskConfig.saveTo | object | Optional | Save Location Configuration. |
taskConfig.saveTo.windows | object | Optional | Configuration for Windows. |
taskConfig.saveTo.windows.location | string | Required | Save Location Type. Valid values are local, repository. |
taskConfig.saveTo.windows.useMostFreeVolume | boolean | Required | Use Volume with most free Space. |
taskConfig.saveTo.windows.repositoryId | string | Optional | Required only if the location is set to repository. |
taskConfig.saveTo.windows.path | string | Optional | Save Path. Required only if the location is set to local. |
taskConfig.saveTo.windows.volume | string | Optional | Volume to save Data. Required if useMostFreeVolume is set to false. Regex Validation - /^[a-zA-Z]:/ The value must follow the format of a single letter (uppercase or lowercase) representing a valid drive, immediately followed by a colon (:). |
taskConfig.saveTo.windows.tmp | string | Optional | Temporary save Path. |
taskConfig.saveTo.windows.directCollection | boolean | Optional | Enable or disable direct Collection. |
taskConfig.saveTo.linux | object | Optional | Configuration for Linux. |
taskConfig.saveTo.linux.location | string | Required | Save Location Type. Valid values are local, repository. |
taskConfig.saveTo.linux.useMostFreeVolume | boolean | Required | Use Volume with most free Space. |
taskConfig.saveTo.linux.repositoryId | string | Optional | Required only if the location is set to repository. |
taskConfig.saveTo.linux.path | string | Optional | Save Path. Required only if the location is set to local. |
taskConfig.saveTo.linux.volume | string | Optional | Volume to save Data. Required if useMostFreeVolume is set to false. Regex Validation - /^[/].*/ Example - "/". |
Input Example
{"json_body":{"caseId":"","droneConfig":{"autoPilot":false,"enabled":false,"analyzers":["bha","wsa","aa","ara"],"keywords":["keyword"]},"taskConfig":{"choice":"use-custom-options","diskSpace":{"reserve":5},"saveTo":{"windows":{"location":"local","useMostFreeVolume":true,"repositoryId":"","path":"Binalyze\\AIR\\","volume":"C:","tmp":"Binalyze\\AIR\\tmp","directCollection":false},"linux":{"location":"local","useMostFreeVolume":true,"repositoryId":"","path":"opt/binalyze/air","volume":"/","tmp":"opt/binalyze/air/tmp","directCollection":false},"macos":{"location":"local","useMostFreeVolume":false,"repositoryId":"","path":"opt/binalyze/air","volume":"/","tmp":"opt/binalyze/air/tmp","directCollection":false},"aix":{"location":"local","useMostFreeVolume":true,"path":"opt/binalyze/air","volume":"/","tmp":"opt/binalyze/air/tmp","directCollection":false}},"cpu":{"limit":80},"compression":{"enabled":true,"encryption":{"enabled":false,"password":""}}},"acquisitionProfileId":"quick","filter":{"searchTerm":"","name":"","ipAddress":"","groupId":"","groupFullPath":"","managedStatus":["unmanaged"],"isolationStatus":["isolating"],"platform":["windows"],"issue":"unreachable","onlineStatus":["online"],"tags":[""],"version":"","policy":"","includedEndpointIds":[""],"excludedEndpointIds":[""],"organizationIds":[0],"label":"","lastSeen":"2023-03-06T21:00:00.000Z","caseId":"","awsRegions":[""],"azureRegions":[""]},"schedulerConfig":{"when":"now","timezoneType":"custom","timezone":"London","startDate":"","recurrence":"weekly","repeatEvery":1,"repeatOnWeek":["MON"],"repeatOnMonth":[""],"endRepeatType":"never","endDate":"","limit":100}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
result | array | Result of the operation |
result._id | string | Unique identifier |
result.name | string | Name of the resource |
result.organizationId | number | Unique identifier |
statusCode | number | Status value |
errors | array | Error message if any |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Fri, 24 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"success":true,"result":[{}],"statusCode":200,"errors":[]}}
Trigger Evidence Collection on Target Endpoint
Initiates evidence collection on a specified endpoint using Binalyze AIR, requiring endpointId and taskId as parameters.
Endpoint
- URL: /api/public/evidence/case/report/{{endpointId}}/{{taskId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.endpointId | string | Required | Unique Identifier for the Endpoint. |
path_parameters.taskId | string | Required | Unique Identifier for the Task. |
Input Example
{"path_parameters":{"endpointId":"string","taskId":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Fri, 24 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{}}
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
content-type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Fri, 24 Jan 2025 20:37:23 GMT |