binalyze
Bridges to the Binalyze AIR digital forensics platform, enabling security teams to query endpoint data, monitor status, and manage investigations through a secure API connection.
List all assets in the system
Get detailed information about a specific asset by its ID
Get all tasks associated with a specific asset by its ID
List all acquisition profiles in the system
Assign an evidence acquisition task to specific endpoints
Get details of a specific acquisition profile by its ID
Assign a disk image acquisition task to specific endpoints and volumes
Create a new acquisition profile
Assign a reboot task to specific endpoints
Assign a shutdown task to specific endpoints
Assign an isolation task to specific endpoints
Assign a log retrieval task to specific endpoints
Assign a version update task to specific endpoints
List all organizations in the system
List all cases in the system
List all policies in the system
List all tasks in the system
List all triage rules in the system
List all users in the system
List all drone analyzers in the system
Initiate an export of audit logs from the AIR system
List audit logs from the AIR system
Uninstall specific assets based on filters without purging data. Requires specifying `filter.includedEndpointIds`.
Purge data and uninstall specific assets based on filters. Requires specifying `filter.includedEndpointIds`.
Add tags to specific assets based on filters. Requires specifying `filter.includedEndpointIds` and `tags`.
Remove tags from specific assets based on filters. Requires specifying `filter.includedEndpointIds` and `tags`.
Create a new rule to automatically tag assets based on specified conditions for Linux, Windows, and macOS.
Update an existing auto asset tag rule.
Get details of a specific auto asset tag rule by its ID
Delete a specific auto asset tag rule by its ID
List all auto asset tag rules in the system.
Start the auto asset tagging process for assets matching filter criteria.
Assign a baseline acquisition task to specific endpoints
Compare baseline acquisition tasks for a specific endpoint
Get comparison result report for a specific endpoint and task
List all acquisition artifacts available for evidence collection
List all e-discovery patterns for file type detection
Create a new policy with specific storage and compression settings
Update an existing policy with specific storage and filter settings
Get detailed information about a specific policy by its ID
Update the priority order of policies
Get statistics on how many endpoints match each policy based on filter criteria
Delete a specific policy by its ID
Get all assignments associated with a specific task by its ID
Cancel a task assignment by its ID
Delete a specific task assignment by its ID
Get detailed information about a specific task by its ID
Cancel a specific task by its ID
Delete a specific task by its ID
List all triage rule tags in the system
Create a new triage rule tag
Create a new triage rule
Update an existing triage rule by ID
Delete an existing triage rule by ID
Get a specific triage rule by its ID
Validate a triage rule syntax without creating it
Assign a triage task to endpoints based on filter criteria
Add a note to a specific case by its ID
Update an existing note in a specific case
Delete a note from a case by its ID
Export cases data from the system
Export notes for a specific case by its ID
Export endpoints for a specific case by its ID
Export activities for a specific case by its ID
Create a new case in the system
Update an existing case by ID
Get detailed information about a specific case by its ID
Close a case by its ID
Open a previously closed case by its ID
Archive a case by its ID
Change the owner of a case
Check if a case name is already in use
Get activity history for a specific case by its ID
Get all endpoints associated with a specific case by its ID
Get all tasks associated with a specific case by its ID
Get all users associated with a specific case by its ID
Remove endpoints from a case based on specified filters
Remove a specific task assignment from a case
Import task assignments to a specific case
List all evidence repositories in the system
Get detailed information about a specific evidence repository by its ID
Create a new SMB evidence repository
Update an existing SMB repository by ID
Create a new SFTP evidence repository
Update an existing SFTP repository
Create a new FTPS evidence repository
Update an existing FTPS evidence repository
Validate FTPS repository configuration without creating it
Create a new Azure Storage repository
Update an existing Azure Storage repository
Validate an Azure Storage repository configuration
Create a new Amazon S3 repository for evidence storage
Update an existing Amazon S3 repository
Validate Amazon S3 repository configuration
Delete an evidence repository by its ID
Download a PPC file for a specific endpoint and task
Download a task report for a specific endpoint and task
Get information about a PPC file for a specific endpoint and task
Get users for a specific organization by its ID
Assign users to a specific organization
Remove a user from an organization
Create a new organization
Update an existing organization by ID
Get detailed information about a specific organization by its ID
Check if an organization name already exists in the system
Get shareable deployment information using a deployment token
Update an organization's shareable deployment settings
Update the deployment token for a specific organization
Delete an organization by its ID
Add tags to an organization
Delete specific tags from an organization
Get detailed information about a specific user by their ID
Call a webhook with the specified parameters
Post data to a webhook
Get all assignments for a specific task by its ID
Update the system banner message settings
Connect to MCP Server
Required environment variables:
AIR_HOST
AIR_API_TOKEN