--- title: Binalyze AIR slug: connectors/binalyze-air docTags: createdAt: 2026-06-09T16:29:42.998Z --- The Binalyze AIR connector allows for automated forensic data acquisition and management directly from within the Swimlane platform. Binalyze AIR is a comprehensive digital forensics platform that simplifies the acquisition and analysis of digital evidence across various operating systems. This connector enables Swimlane Turbine users to automate the creation of acquisition profiles, trigger evidence collection tasks, and initiate evidence collection on specific endpoints. By integrating with Binalyze AIR, security teams can streamline their digital forensics processes, reduce response times, and ensure consistent evidence handling within the Swimlane Turbine platform. ### Limitations None to date. ### Supported Versions This Binalyze AIR connector uses the latest Version API. ### Additional Docs - [Binalyze AIR Authentication Link](https://docs.binalyze.com/#authentication) - [Binalyze AIR API Documentation Link](https://docs.binalyze.com/#intro) ## Configuration ### Prerequisites Before utilizing the Binalyze AIR connector within Swimlane, ensure you have the following prerequisites: - HTTP Bearer Token Authentication with the following parameters: - URL: The endpoint URL for the Binalyze AIR API. - Token: A valid bearer token to authenticate API requests. ## Authentication Methods ### Bearer Token Authentication: - URL: The endpoint URL for the Binalyze AIR API. - Access Token: A valid Token to authenticate API requests. ## Capabilities This Binalyze AIR Connector provides the following capabilities: - Create an Acquisition Profile - Trigger Collection Based on Acquisition Profile - Trigger Evidence Collection on Target Endpoint ### Create an Acquisition Profile Create a new Acquisition Profile in Binalyze AIR. permission needed: create-acquisition-profile. Binalyze AIR's documentation for this action can be found [here](https://docs.binalyze.com/#ad65add9-1b5d-437b-bd1c-3aed45528650). ### Trigger Collection Based on Acquisition Profile Assigns an Evidence Acquisition Task using specified Filters. Binalyze AIR's documentation for this action can be found [here](https://docs.binalyze.com/#5c96f97a-c2b8-400a-ac7d-47ea806ff975). ### Trigger Evidence Collection on Target Endpoint Retrieve the Task Report for a specific Endpoint. Binalyze AIR's documentation for this action can be found [here](https://docs.binalyze.com/#4f4ba4e5-6879-421c-ae5f-5ec7b13bcb57). # Configurations ## Binalyze AIR HTTP Bearer Authentication Authenticates using bearer token. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API token. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create an Acquisition Profile Create a new Acquisition Profile in Binalyze AIR using the provided JSON body data. ### Endpoint - **URL:** `/api/public/acquisitions/profiles` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | --------------------------------------- | | `name` | string | Optional | Name of the Acquisition Profile. | | `organizationIds` | array | Optional | List of Organization IDs. | | `windows` | object | Optional | Configuration for Windows Systems. | | `windows.evidenceList` | array | Optional | List of Evidence Types for Windows. | | `windows.artifactList` | array | Optional | List of Artifacts for Windows. | | `windows.customContentProfiles` | array | Optional | Custom Content Profiles for Windows. | | `windows.networkCapture` | object | Optional | Network Capture Settings for Windows. | | `windows.networkCapture.enabled` | boolean | Optional | Enable or disable Network Capture. | | `windows.networkCapture.duration` | number | Optional | Duration of Network Capture in Seconds. | | `windows.networkCapture.pcap` | object | Optional | PCAP Settings for Network Capture. | | `windows.networkCapture.pcap.enabled` | boolean | Optional | Enable or disable PCAP Capture. | | `windows.networkCapture.networkFlow` | object | Optional | Network flow Settings for Capture. | | `windows.networkCapture.networkFlow.enabled` | boolean | Optional | Enable or disable Network Flow Capture. | | `linux` | object | Optional | Configuration for Linux Systems. | | `linux.evidenceList` | array | Optional | List of Evidence Types for Linux. | | `linux.artifactList` | array | Optional | List of Artifacts for Linux. | | `linux.customContentProfiles` | array | Optional | Custom Content Profiles for Linux. | | `linux.networkCapture` | object | Optional | Network Capture Settings for Linux. | | `linux.networkCapture.enabled` | boolean | Optional | Enable or disable Network Capture. | | `linux.networkCapture.duration` | number | Optional | Duration of Network Capture in Seconds. | | `linux.networkCapture.pcap` | object | Optional | PCAP Settings for Network Capture. | | `linux.networkCapture.pcap.enabled` | boolean | Optional | Enable or disable PCAP Capture. | | `linux.networkCapture.networkFlow` | object | Optional | Network flow Settings for Capture. | | `linux.networkCapture.networkFlow.enabled` | boolean | Optional | Enable or disable Network Flow Capture. | | `macos` | object | Optional | Configuration for MacOS Systems. | ### Input Example `{"json_body":{"name":"Sample Acquisition Profile","organizationIds":[0],"windows":{"evidenceList":["clp"],"artifactList":["apcl"],"customContentProfiles":[],"networkCapture":{"enabled":true,"duration":600,"pcap":{"enabled":true},"networkFlow":{"enabled":true}}},"linux":{"evidenceList":["syscntrls"],"artifactList":["apcl"],"customContentProfiles":[],"networkCapture":{"enabled":false,"duration":600,"pcap":{"enabled":false},"networkFlow":{"enabled":false}}},"macos":{"evidenceList":["autoproc"],"artifactList":["apcl"],"customContentProfiles":[],"networkCapture":{"enabled":false,"duration":600,"pcap":{"enabled":false},"networkFlow":{"enabled":false}}},"aix":{"evidenceList":["cronj"],"artifactList":["myl"],"customContentProfiles":[]},"eDiscovery":{"patterns":[{"pattern":"**/*.7z","category":"Archives"}]}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `result` | object | Result of the operation | | `statusCode` | number | Status value | | `errors` | array | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Fri, 24 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"success":true,"result":null,"statusCode":200,"errors":[]}}` ## Trigger Collection Based on Acquisition Profile Initiates an evidence collection task in Binalyze AIR using a specified acquisition profile and drone configuration. ### Endpoint - **URL:** `/api/public/acquisitions/acquire` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `caseId` | string | Optional | Optional Case Identifier. | | `droneConfig` | object | Optional | Configuration for the Drone. | | `droneConfig.autoPilot` | boolean | Required | Enable or disable Auto Pilot. | | `droneConfig.enabled` | boolean | Required | Enable or disable Drone. | | `droneConfig.analyzers` | array | Required | List of Analyzers to use. Valid values - /api/public/params/drone/analyzers. | | `droneConfig.keywords` | array | Optional | Optional List of Keywords. | | `taskConfig` | object | Optional | Configuration for the Task. | | `taskConfig.choice` | string | Required | Task Configuration Choice. Valid values are use-policy, use-custom-options. | | `taskConfig.diskSpace` | object | Optional | Parameter for Trigger Collection Based on Acquisition Profile | | `taskConfig.diskSpace.reserve` | number | Optional | The value is expressed in bytes. | | `taskConfig.saveTo` | object | Optional | Save Location Configuration. | | `taskConfig.saveTo.windows` | object | Optional | Configuration for Windows. | | `taskConfig.saveTo.windows.location` | string | Required | Save Location Type. Valid values are local, repository. | | `taskConfig.saveTo.windows.useMostFreeVolume` | boolean | Required | Use Volume with most free Space. | | `taskConfig.saveTo.windows.repositoryId` | string | Optional | Required only if the location is set to repository. | | `taskConfig.saveTo.windows.path` | string | Optional | Save Path. Required only if the location is set to local. | | `taskConfig.saveTo.windows.volume` | string | Optional | Volume to save Data. Required if useMostFreeVolume is set to false. Regex Validation - /^\[a-zA-Z]:/ The value must follow the format of a single letter (uppercase or lowercase) representing a valid drive, immediately followed by a colon (:). | | `taskConfig.saveTo.windows.tmp` | string | Optional | Temporary save Path. | | `taskConfig.saveTo.windows.directCollection` | boolean | Optional | Enable or disable direct Collection. | | `taskConfig.saveTo.linux` | object | Optional | Configuration for Linux. | | `taskConfig.saveTo.linux.location` | string | Required | Save Location Type. Valid values are local, repository. | | `taskConfig.saveTo.linux.useMostFreeVolume` | boolean | Required | Use Volume with most free Space. | | `taskConfig.saveTo.linux.repositoryId` | string | Optional | Required only if the location is set to repository. | | `taskConfig.saveTo.linux.path` | string | Optional | Save Path. Required only if the location is set to local. | | `taskConfig.saveTo.linux.volume` | string | Optional | Volume to save Data. Required if useMostFreeVolume is set to false. Regex Validation - /^\[/].\*/ Example - "/". | ### Input Example `{"json_body":{"caseId":"","droneConfig":{"autoPilot":false,"enabled":false,"analyzers":["bha","wsa","aa","ara"],"keywords":["keyword"]},"taskConfig":{"choice":"use-custom-options","diskSpace":{"reserve":5},"saveTo":{"windows":{"location":"local","useMostFreeVolume":true,"repositoryId":"","path":"Binalyze\\AIR\\","volume":"C:","tmp":"Binalyze\\AIR\\tmp","directCollection":false},"linux":{"location":"local","useMostFreeVolume":true,"repositoryId":"","path":"opt/binalyze/air","volume":"/","tmp":"opt/binalyze/air/tmp","directCollection":false},"macos":{"location":"local","useMostFreeVolume":false,"repositoryId":"","path":"opt/binalyze/air","volume":"/","tmp":"opt/binalyze/air/tmp","directCollection":false},"aix":{"location":"local","useMostFreeVolume":true,"path":"opt/binalyze/air","volume":"/","tmp":"opt/binalyze/air/tmp","directCollection":false}},"cpu":{"limit":80},"compression":{"enabled":true,"encryption":{"enabled":false,"password":""}}},"acquisitionProfileId":"quick","filter":{"searchTerm":"","name":"","ipAddress":"","groupId":"","groupFullPath":"","managedStatus":["unmanaged"],"isolationStatus":["isolating"],"platform":["windows"],"issue":"unreachable","onlineStatus":["online"],"tags":[""],"version":"","policy":"","includedEndpointIds":[""],"excludedEndpointIds":[""],"organizationIds":[0],"label":"","lastSeen":"2023-03-06T21:00:00.000Z","caseId":"","awsRegions":[""],"azureRegions":[""]},"schedulerConfig":{"when":"now","timezoneType":"custom","timezone":"London","startDate":"","recurrence":"weekly","repeatEvery":1,"repeatOnWeek":["MON"],"repeatOnMonth":[""],"endRepeatType":"never","endDate":"","limit":100}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `result` | array | Result of the operation | | `result._id` | string | Unique identifier | | `result.name` | string | Name of the resource | | `result.organizationId` | number | Unique identifier | | `statusCode` | number | Status value | | `errors` | array | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Fri, 24 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"success":true,"result":[{}],"statusCode":200,"errors":[]}}` ## Trigger Evidence Collection on Target Endpoint Initiates evidence collection on a specified endpoint using Binalyze AIR, requiring endpointId and taskId as parameters. ### Endpoint - **URL:** `/api/public/evidence/case/report/{{endpointId}}/{{taskId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.endpointId` | string | Required | Unique Identifier for the Endpoint. | | `path_parameters.taskId` | string | Required | Unique Identifier for the Task. | ### Input Example `{"path_parameters":{"endpointId":"string","taskId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Fri, 24 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | -------------- | ----------------------------------------------------- | ----------------------------- | | content-length | The length of the response body in bytes | 140 | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Fri, 24 Jan 2025 20:37:23 GMT |