Skip to content
One platform. From customer conversation to completed work.Take a closer look
All connections
Security & Identity ยท CONNECTION

Binalyze AIR + NodeHub

Read Binalyze AIR assets, cases, tasks and rules, tag, isolate, reboot or shut down endpoints, and manage cases.

Explore 29 workflow actions for Binalyze AIR, including account permissions and operation limits.

17 read actions12 write actions
WORKFLOW ACTIONS

What you can configure.

Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.

Add asset tags

Write

Add tags to the listed endpoints.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Add case note

Write

Add a note to a case.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Archive case

Write

Archive case by ID.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Cancel task

Write

Cancel a task on every endpoint still waiting.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Close case

Write

Close case by ID.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create case

Write

Open a case with an owner and visibility.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Get acquisition profile

Read

Read an acquisition profile.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get app info

Read

Read the console and responder versions and enabled features.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get asset

Read

Read an asset's platform, status, isolation and tags.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get asset tasks

Read

List the tasks run on an asset.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get case

Read

Read a case.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get case activities

Read

List a case's activity log.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get case endpoints

Read

List the endpoints in a case.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get case tasks

Read

List the tasks in a case.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get task

Read

Read a task.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Get task assignments

Read

List a task's per-endpoint assignments and their status.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Isolate or release endpoints

Write

Turn network isolation on or off for the listed endpoints.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

List acquisition profiles

Read

List an organization's evidence acquisition profiles.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

List assets

Read

List an organization's assets (endpoints).

Permissions and limits

Account permissions

  • A Binalyze AIR API token

List cases

Read

List an organization's cases.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

List organizations

Read

List organizations.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

List tasks

Read

List an organization's tasks with their progress.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

List triage rules

Read

List an organization's triage (YARA, Sigma, osquery) rules.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

List users

Read

List an organization's users.

Permissions and limits

Account permissions

  • A Binalyze AIR API token

Reboot endpoints

Write

Reboot the listed endpoints.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Remove asset tags

Write

Remove tags from the listed endpoints.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Reopen case

Write

Reopen case by ID.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Shut down endpoints

Write

Shut down the listed endpoints.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update case

Write

Rename a case or change who is assigned.

Permissions and limits

Account permissions

  • A Binalyze AIR API token with the needed role

A repeated request may repeat the external action. Review the previous result before retrying a write.

SETUP

Start with a controlled test.

01Connect the intended account

Use the account and permissions required for your process. Review the connection check before configuring a workflow action.

02Review inputs and access

Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.

03Confirm the result

Inspect step outputs and confirm the result in Binalyze AIR. A saved workflow is not a completed provider action.

Follow the workflow quickstart
EXPLORE YOUR STACK

More in Security & Identity.

AbuseIPDBAlienVault OTXAllowlyAmbriel
Binalyze AIR integration | NodeHub