# AIR - [AIR Platform](/air/home.md): AIR is an Automated Investigation and Response platform offering the most comprehensive feature set for remotely acquiring 759 types of digital evidence in just minutes. - [What is AIR?](/air/home/what-is-the-platform.md): Automated Investigation and Response platform - [Terminology](/air/home/terminology.md): A brief overview of AIR terminology - [Architecture](/air/home/architecture.md): A brief overview of system architecture - [AIR Responder Architecture; overview and performance analysis](/air/home/architecture/responder-architecture-overview-and-performance-analysis.md) - [AIR Task Flow and Management](/air/home/architecture/task-flow-and-management.md) - [Network Communication](/air/home/network.md): How do assets communicate with the console? - [Cloud Forensics](/air/home/cloud-forensics.md) - [GCP Deployment: Technical Details](/air/home/cloud-forensics/gcp-deployment-technical-details.md) - [Setup](/air/setup.md): AIR setup instructions - [Relay Server](/air/setup/relay-server.md) - [RelayPro](/air/setup/relay-server/relay-server-pro.md) - [Proxy configurations (Legacy)](/air/setup/relay-server/proxy-configurations.md) - [Adding proxy to Relay Server](/air/setup/relay-server/proxy-configurations/adding-proxy-to-relay-server.md) - [Legacy Relay Server (Deprecated)](/air/setup/relay-server/what-is-relay-server.md) - [Requirements for installation](/air/setup/relay-server/what-is-relay-server/requirements-for-installation.md) - [How to install a Relay Server on different Linux platforms](/air/setup/relay-server/what-is-relay-server/how-to-install-a-relay-server-on-different-linux-platforms.md) - [How to change IP address of Relay Server](/air/setup/relay-server/what-is-relay-server/how-to-change-ip-address-of-relay-server.md) - [How to install a Responder with Relay Server support](/air/setup/relay-server/what-is-relay-server/how-to-install-a-responder-with-relay-server-support.md) - [Service Management for Relay Server](/air/setup/relay-server/what-is-relay-server/service-management-for-relay-server.md) - [Whitelisting for Relay Server](/air/setup/relay-server/what-is-relay-server/whitelisting-for-relay-server.md) - [Retrieving metrics from Relay Server](/air/setup/relay-server/what-is-relay-server/retrieving-metrics-from-relay-server.md) - [Updating and Uninstalling Relay Server](/air/setup/relay-server/what-is-relay-server/updating-and-uninstalling-relay-server.md) - [Troubleshooting](/air/setup/relay-server/what-is-relay-server/troubleshooting.md) - [Responder](/air/setup/responder-deployment.md) - [Responder Hardware Requirements](/air/setup/responder-deployment/responder-hardware-requirements.md) - [Responder - Supported Operating Systems](/air/setup/responder-deployment/responder-supported-operating-systems.md): Operating Systems that are supported by the responder - [Responder - MS Windows supported systems](/air/setup/responder-deployment/responder-supported-operating-systems/responder-ms-windows-supported-systems.md) - [Responder - Apple macOS supported systems](/air/setup/responder-deployment/responder-supported-operating-systems/responder-apple-macos-supported-systems.md) - [Responder - Linux (DEB/RPM) supported systems](/air/setup/responder-deployment/responder-supported-operating-systems/responder-linux-deb-rpm-supported-systems.md) - [ESXi Standalone Collector](/air/setup/responder-deployment/responder-supported-operating-systems/esxi-standalone-collector.md) - [Responder - Chrome supported systems](/air/setup/responder-deployment/responder-supported-operating-systems/responder-chrome-supported-systems.md) - [AIR For Chrome](/air/setup/responder-deployment/responder-supported-operating-systems/responder-chrome-supported-systems/agent-for-chrome.md): 1- Click evidence collection for Chrome - [Responder for Golden Images](/air/setup/responder-deployment/golden-image.md) - [Responder and Active Directory OUs](/air/setup/responder-deployment/responder-and-active-directory-ous.md) - [Responder Exception Rules for EPP and EDR](/air/setup/responder-deployment/responder-exception-rules.md) - [AIR Watchdog Folder](/air/setup/responder-deployment/responder-exception-rules/watchdog-folder.md) - [FDA via Jamf and Apple's PPPC utility](/air/setup/responder-deployment/fda-via-jamf-and-apples-pppc-utility.md) - [Responder Tamper Detection](/air/setup/responder-deployment/responder-tamper-detection.md) - [Responder in Windows Safe Mode](/air/setup/responder-deployment/responder-in-windows-safe-mode.md): AIR Responder Operation in Windows Safe Mode - [Proxy Configurations](/air/setup/responder-deployment/proxy-configurations.md) - [Adding proxy to Responder](/air/setup/responder-deployment/proxy-configurations/adding-proxy-to-responder.md) - [Additional Proxy Details](/air/setup/responder-deployment/proxy-configurations/additional-proxy-details.md) - [Security](/air/setup/security.md) - [Two-factor authentication (2FA)](/air/setup/security/two-factor-authentication-2fa.md) - [Settings](/air/settings.md) - [Console Settings](/air/settings/console-settings.md) - [General](/air/settings/console-settings/general.md) - [Assets](/air/settings/console-settings/assets.md) - [Security](/air/settings/console-settings/security.md) - [Features](/air/settings/console-settings/features.md) - [Evidence Repositories](/air/settings/console-settings/evidence-repositories.md) - [Policies](/air/settings/console-settings/policies.md) - [User Management](/air/settings/console-settings/user-management.md) - [User Groups](/air/settings/console-settings/user-management/user-groups.md) - [User Roles](/air/settings/console-settings/user-management/user-roles.md) - [Backup](/air/settings/console-settings/backup.md) - [Investigation Hub Disk Usage](/air/settings/console-settings/investigation-hub-disk-usage.md) - [Danger Zone](/air/settings/console-settings/danger-zone.md) - [Organization Settings](/air/settings/organization-settings.md) - [Account Settings](/air/settings/account-settings.md) - [Submitting Feedback](/air/settings/submitting-feedback.md): How to submit feedback, bug reports, and questions directly from the AIR Console - [Updating](/air/updating.md): Updating the AIR console - [Console Updating - SaaS](/air/updating/console-updating-saas.md) - [Features](/air/features.md): Fast, remote, and scalable across the corporate network - [API](/air/features/api.md): Explore our comprehensive resource at docs.binalyze.com. - [API is likely to be more effective than Webhooks](/air/features/api/api-is-likely-to-be-more-effective-than-webhooks.md) - [Asset Isolation](/air/features/asset-isolation.md): Isolating assets from all network access except the AIR Console - [Maintenance Mode](/air/features/asset-isolation/maintenance-mode.md): Preventing task creation for assets during maintenance or diagnostic sessions - [Acquisition](/air/features/acquisition.md) - [Acquisition Profiles](/air/features/acquisition/acquisition-profiles.md) - [Supported Evidence](/air/features/acquisition/acquisition-profiles/supported-evidence.md): These pages categorize the supported evidence and artifacts by OS, indicating whether each item is parsed and presented in the Investigation Hub and/or if the associated file is collected. - [Windows Collections](/air/features/acquisition/acquisition-profiles/windows-collections.md): AIR supports the following Windows Evidences - [$Boot](/air/features/acquisition/acquisition-profiles/windows-collections/boot.md) - [$LogFile](/air/features/acquisition/acquisition-profiles/windows-collections/log-file.md) - [$Secure:$SDS](/air/features/acquisition/acquisition-profiles/windows-collections/securesds.md) - [$TxfLog $Tops:$T](/air/features/acquisition/acquisition-profiles/windows-collections/txflog-topst.md) - [Action1 RMM Logs](/air/features/acquisition/acquisition-profiles/windows-collections/action1-rmm-logs.md) - [Active Directory Logs](/air/features/acquisition/acquisition-profiles/windows-collections/active-directory-logs.md) - [Active Script Event Consumers](/air/features/acquisition/acquisition-profiles/windows-collections/wmi-active-script.md) - [AmCache](/air/features/acquisition/acquisition-profiles/windows-collections/amcache.md) - [AmmyAdmin Logs](/air/features/acquisition/acquisition-profiles/windows-collections/ammyadmin-logs.md) - [Antivirus Information](/air/features/acquisition/acquisition-profiles/windows-collections/antivirus-information.md) - [AnyDesk Logs](/air/features/acquisition/acquisition-profiles/windows-collections/anydesk-logs.md) - [Apache Logs](/air/features/acquisition/acquisition-profiles/windows-collections/apache-logs.md) - [AppCompatCache](/air/features/acquisition/acquisition-profiles/windows-collections/appcompactcache.md) - [AppPaths](/air/features/acquisition/acquisition-profiles/windows-collections/apppaths.md) - [ARP Table](/air/features/acquisition/acquisition-profiles/windows-collections/arp-table.md) - [Avast Logs](/air/features/acquisition/acquisition-profiles/windows-collections/avast-logs.md) - [AVG Logs](/air/features/acquisition/acquisition-profiles/windows-collections/avg-logs.md) - [Avira Logs](/air/features/acquisition/acquisition-profiles/windows-collections/avira-logs.md) - [Bitdefender Logs](/air/features/acquisition/acquisition-profiles/windows-collections/bitdefender-logs.md) - [Brave Bookmarks](/air/features/acquisition/acquisition-profiles/windows-collections/brave-bookmarks.md) - [Brave Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/brave-browsing-history.md) - [Brave Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/brave-cookies.md) - [Brave Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/brave-downloads.md) - [Brave Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/brave-extensions.md) - [Brave Favicons](/air/features/acquisition/acquisition-profiles/windows-collections/brave-favicons.md) - [Brave Form History](/air/features/acquisition/acquisition-profiles/windows-collections/brave-form-history.md) - [Brave Local Storage](/air/features/acquisition/acquisition-profiles/windows-collections/brave-local-storage.md) - [Brave Login Data](/air/features/acquisition/acquisition-profiles/windows-collections/brave-login-data.md) - [Brave Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/brave-sessions.md) - [Brave Thumbnails](/air/features/acquisition/acquisition-profiles/windows-collections/brave-thumbnails.md) - [Brave User Profiles](/air/features/acquisition/acquisition-profiles/windows-collections/brave-user-profiles.md) - [Brave Web Storage](/air/features/acquisition/acquisition-profiles/windows-collections/brave-web-storage.md) - [Carbon Black Logs](/air/features/acquisition/acquisition-profiles/windows-collections/carbon-black-logs.md) - [Chrome Bookmarks](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-bookmarks.md) - [Chrome Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-browsing-history.md) - [Chrome Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-cookies.md) - [Chrome Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-downloads.md) - [Chrome Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-extensions.md) - [Chrome Favicons](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-favicons.md) - [Chrome Form History](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-form-history.md) - [Chrome Local Storage](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-local-storage.md) - [Chrome Login Data](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-login-data.md) - [Chrome Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-sessions.md) - [Chrome Thumbnails](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-thumbnails.md) - [Chrome User Profiles](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-user-profiles.md) - [Chrome Web Storage](/air/features/acquisition/acquisition-profiles/windows-collections/chrome-web-storage.md) - [CIDSizeMRU](/air/features/acquisition/acquisition-profiles/windows-collections/cidsizemru.md) - [CLR](/air/features/acquisition/acquisition-profiles/windows-collections/clr.md) - [Cisco AMP Logs](/air/features/acquisition/acquisition-profiles/windows-collections/cisco-amp-logs.md) - [Collect LNK Files](/air/features/acquisition/acquisition-profiles/windows-collections/collect-lnk-files.md) - [Collect SRUM Database Files](/air/features/acquisition/acquisition-profiles/windows-collections/collect-srum-database-files.md) - [ComboFix](/air/features/acquisition/acquisition-profiles/windows-collections/combofix.md) - [Command Line Event Consumers](/air/features/acquisition/acquisition-profiles/windows-collections/wmi-command-line.md) - [Cortana History](/air/features/acquisition/acquisition-profiles/windows-collections/cortana-history.md) - [Crash Dump Information](/air/features/acquisition/acquisition-profiles/windows-collections/crash-dump-information.md) - [Cybereason Logs](/air/features/acquisition/acquisition-profiles/windows-collections/cybereason-logs.md) - [Cylance Logs](/air/features/acquisition/acquisition-profiles/windows-collections/cylance-logs.md) - [Deep Instinct Logs](/air/features/acquisition/acquisition-profiles/windows-collections/deep-instinct-logs.md) - [Default Browser](/air/features/acquisition/acquisition-profiles/windows-collections/default-browser.md) - [DHCP Server Logs](/air/features/acquisition/acquisition-profiles/windows-collections/dhcp-server-logs.md) - [Discord Desktop Cache](/air/features/acquisition/acquisition-profiles/windows-collections/discord-desktop-cache.md) - [DNS Cache](/air/features/acquisition/acquisition-profiles/windows-collections/dns-cache.md) - [DNS Server Logs](/air/features/acquisition/acquisition-profiles/windows-collections/dns-server-logs.md) - [DNS Servers](/air/features/acquisition/acquisition-profiles/windows-collections/dns-servers.md) - [Docker Changes](/air/features/acquisition/acquisition-profiles/windows-collections/docker-changes.md) - [Docker Container Logs](/air/features/acquisition/acquisition-profiles/windows-collections/docker-container-logs.md) - [Docker Containers](/air/features/acquisition/acquisition-profiles/windows-collections/docker-containers.md) - [Docker Image History](/air/features/acquisition/acquisition-profiles/windows-collections/docker-image-history.md) - [Docker Images](/air/features/acquisition/acquisition-profiles/windows-collections/docker-images.md) - [Docker Info](/air/features/acquisition/acquisition-profiles/windows-collections/docker-info.md) - [Docker Networks](/air/features/acquisition/acquisition-profiles/windows-collections/docker-networks.md) - [Docker Tops](/air/features/acquisition/acquisition-profiles/windows-collections/docker-processes.md) - [Docker Volumes](/air/features/acquisition/acquisition-profiles/windows-collections/docker-volumes.md) - [Downloaded Files Information](/air/features/acquisition/acquisition-profiles/windows-collections/downloaded-files-information.md) - [Driver Objects](/air/features/acquisition/acquisition-profiles/windows-collections/driver-objects.md) - [Drivers List](/air/features/acquisition/acquisition-profiles/windows-collections/drivers-list.md) - [Dropbox Cache](/air/features/acquisition/acquisition-profiles/windows-collections/dropbox-cache.md) - [Dropbox Databases](/air/features/acquisition/acquisition-profiles/windows-collections/dropbox-databases.md) - [Dropbox Logs](/air/features/acquisition/acquisition-profiles/windows-collections/dropbox-logs.md) - [Dump Brave Indexed DB](/air/features/acquisition/acquisition-profiles/windows-collections/dump-brave-indexed-db.md) - [Dump Chrome Indexed DB](/air/features/acquisition/acquisition-profiles/windows-collections/dump-chrome-indexed-db.md) - [Dump Edge Indexed DB](/air/features/acquisition/acquisition-profiles/windows-collections/dump-edge-indexed-db.md) - [Dump Opera Indexed DB](/air/features/acquisition/acquisition-profiles/windows-collections/dump-opera-indexed-db.md) - [Dump QQ Indexed DB](/air/features/acquisition/acquisition-profiles/windows-collections/dump-qq-indexed-db.md) - [Dump Vivaldi Indexed DB](/air/features/acquisition/acquisition-profiles/windows-collections/dump-vivaldi-indexed-db.md) - [Edge Bookmarks](/air/features/acquisition/acquisition-profiles/windows-collections/edge-bookmarks.md) - [Edge Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/edge-cookies.md) - [Edge Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/edge-downloads.md) - [Edge Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/edge-extensions.md) - [Edge Favicons](/air/features/acquisition/acquisition-profiles/windows-collections/edge-favicons.md) - [Edge Form History](/air/features/acquisition/acquisition-profiles/windows-collections/edge-form-history.md) - [Edge Local Storage](/air/features/acquisition/acquisition-profiles/windows-collections/edge-local-storage.md) - [Edge Login Data](/air/features/acquisition/acquisition-profiles/windows-collections/edge-login-data.md) - [Edge Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/edge-sessions.md) - [Edge Thumbnails](/air/features/acquisition/acquisition-profiles/windows-collections/edge-thumbnails.md) - [Edge User Profiles](/air/features/acquisition/acquisition-profiles/windows-collections/edge-user-profiles.md) - [Edge Web Storage](/air/features/acquisition/acquisition-profiles/windows-collections/edge-web-storage.md) - [Elastic Logs](/air/features/acquisition/acquisition-profiles/windows-collections/elastic-logs.md) - [Environment Variables](/air/features/acquisition/acquisition-profiles/windows-collections/environment-variables.md) - [Eset Logs](/air/features/acquisition/acquisition-profiles/windows-collections/eset-logs.md) - [ETL](/air/features/acquisition/acquisition-profiles/windows-collections/etl.md) - [Event Log EVT Files](/air/features/acquisition/acquisition-profiles/windows-collections/event-log-evt-files.md) - [Event Log EVT Records](/air/features/acquisition/acquisition-profiles/windows-collections/event-log-evt-records.md) - [Windows Event Records and How They Are Handled](/air/features/acquisition/acquisition-profiles/windows-collections/event-log-evt-records/windows-event-records-and-how-they-are-handled.md) - [Event Log EVTX Files](/air/features/acquisition/acquisition-profiles/windows-collections/event-log-evtx-files.md) - [EventTranscript DB](/air/features/acquisition/acquisition-profiles/windows-collections/eventtranscript-db.md) - [Evernote Databases](/air/features/acquisition/acquisition-profiles/windows-collections/evernote-databases.md) - [Evernote Drag and Drop Files](/air/features/acquisition/acquisition-profiles/windows-collections/evernote-drag-and-drop-files.md) - [Evernote Logs](/air/features/acquisition/acquisition-profiles/windows-collections/evernote-logs.md) - [Everything History](/air/features/acquisition/acquisition-profiles/windows-collections/everything-history.md) - [F-Secure Logs](/air/features/acquisition/acquisition-profiles/windows-collections/f-secure-logs.md) - [Facebook Cache](/air/features/acquisition/acquisition-profiles/windows-collections/facebook-cache.md) - [Facebook Databases](/air/features/acquisition/acquisition-profiles/windows-collections/facebook-databases.md) - [FileExts](/air/features/acquisition/acquisition-profiles/windows-collections/fileexts.md) - [FileZilla Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/filezilla-sessions.md) - [FireEye Logs](/air/features/acquisition/acquisition-profiles/windows-collections/fireeye-logs.md) - [Firefox Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/firefox-browsing-history.md) - [Firefox Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/firefox-cookies.md) - [Firefox Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/firefox-downloads.md) - [Firefox Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/firefox-extensions.md) - [Firewall Rules](/air/features/acquisition/acquisition-profiles/windows-collections/firewall-rules.md) - [FirstFolder](/air/features/acquisition/acquisition-profiles/windows-collections/firstfolder.md) - [Github Desktop Cache](/air/features/acquisition/acquisition-profiles/windows-collections/github-desktop-cache.md) - [Github Desktop Databases](/air/features/acquisition/acquisition-profiles/windows-collections/github-desktop-databases.md) - [Github Desktop Logs](/air/features/acquisition/acquisition-profiles/windows-collections/github-desktop-logs.md) - [Google Drive Databases](/air/features/acquisition/acquisition-profiles/windows-collections/google-drive-databases.md) - [GoTo Logs](/air/features/acquisition/acquisition-profiles/windows-collections/goto-logs.md) - [Hibernation File](/air/features/acquisition/acquisition-profiles/windows-collections/hibernation-file.md) - [HitmanPro Logs](/air/features/acquisition/acquisition-profiles/windows-collections/hitmanpro-logs.md) - [Hosts File](/air/features/acquisition/acquisition-profiles/windows-collections/hosts.md) - [Iconcache](/air/features/acquisition/acquisition-profiles/windows-collections/iconcache.md) - [IE 10,11,Edge Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/ie-1011edge-browsing-history.md) - [IE 7,8,9 Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/ie-789-browsing-history.md) - [IIS Logs](/air/features/acquisition/acquisition-profiles/windows-collections/iis-logs.md) - [INF Setup](/air/features/acquisition/acquisition-profiles/windows-collections/inf-setup.md) - [Installed Applications](/air/features/acquisition/acquisition-profiles/windows-collections/installed-applications.md) - [IPv4 Routes](/air/features/acquisition/acquisition-profiles/windows-collections/ipv4-routes.md) - [iTunes Backups](/air/features/acquisition/acquisition-profiles/windows-collections/itunes-backups.md) - [JumpList Automatic Entries](/air/features/acquisition/acquisition-profiles/windows-collections/jumplist-automatic-entries.md) - [JumpList Automatic Files](/air/features/acquisition/acquisition-profiles/windows-collections/jumplist-automatic-files.md) - [JumpList Custom Entries](/air/features/acquisition/acquisition-profiles/windows-collections/jumplist-custom-entries.md) - [JumpList Custom Files](/air/features/acquisition/acquisition-profiles/windows-collections/jumplist-custom-files.md) - [Kaseya Logs](/air/features/acquisition/acquisition-profiles/windows-collections/kaseya-logs.md) - [LastVisitedPidlMRU](/air/features/acquisition/acquisition-profiles/windows-collections/lastvisitedpidlmru.md) - [Level Logs](/air/features/acquisition/acquisition-profiles/windows-collections/level-logs.md) - [LinkedIn Cache](/air/features/acquisition/acquisition-profiles/windows-collections/linkedin-cache.md) - [LogMeIn Logs](/air/features/acquisition/acquisition-profiles/windows-collections/logmein-logs.md) - [MalwareBytes Logs](/air/features/acquisition/acquisition-profiles/windows-collections/malwarebytes-logs.md) - [Map Network Drive MRU](/air/features/acquisition/acquisition-profiles/windows-collections/map-network-drive-mru.md) - [MBR](/air/features/acquisition/acquisition-profiles/windows-collections/mbr.md) - [McAfee Logs](/air/features/acquisition/acquisition-profiles/windows-collections/mcafee-logs.md) - [MFT](/air/features/acquisition/acquisition-profiles/windows-collections/mft.md) - [MFT as CSV](/air/features/acquisition/acquisition-profiles/windows-collections/mft-as-csv.md) - [MFT Mirror](/air/features/acquisition/acquisition-profiles/windows-collections/mft-mirror.md) - [Microsoft Calendar](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-calendar.md) - [Microsoft Exchange Logs](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-exchange-logs.md) - [Microsoft Mail](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-mail.md) - [Microsoft Maps](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-maps.md) - [Microsoft Outlook](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-outlook.md) - [Microsoft People](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-people.md) - [Microsoft Photos](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-photos.md) - [Microsoft Sticky Notes](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-sticky-notes.md) - [Microsoft Store Applications List](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-store-applications-list.md) - [Microsoft Voice Record History](/air/features/acquisition/acquisition-profiles/windows-collections/microsoft-voice-record-history.md) - [MongoDB Logs](/air/features/acquisition/acquisition-profiles/windows-collections/mongodb-logs.md) - [Mozilla Thunderbird](/air/features/acquisition/acquisition-profiles/windows-collections/mozilla-thunderbird.md) - [MSSQL Logs](/air/features/acquisition/acquisition-profiles/windows-collections/mssql-logs.md) - [Network Adapters](/air/features/acquisition/acquisition-profiles/windows-collections/network-adapters.md) - [Network Shares](/air/features/acquisition/acquisition-profiles/windows-collections/network-shares.md) - [Notepad++ Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/notepad-sessions.md) - [NTDS dit](/air/features/acquisition/acquisition-profiles/windows-collections/ntdsdit.md) - [Object Directory](/air/features/acquisition/acquisition-profiles/windows-collections/object-directory.md) - [OfficeMRU](/air/features/acquisition/acquisition-profiles/windows-collections/officemru.md) - [Old Registry Hives](/air/features/acquisition/acquisition-profiles/windows-collections/old-registry-hives.md) - [OneDrive Logs](/air/features/acquisition/acquisition-profiles/windows-collections/onedrive-logs.md) - [OpenSavePidlMRU](/air/features/acquisition/acquisition-profiles/windows-collections/opensavepidlmru.md) - [OpenVPN Config](/air/features/acquisition/acquisition-profiles/windows-collections/openvpn-config.md) - [Opera Bookmarks](/air/features/acquisition/acquisition-profiles/windows-collections/opera-bookmarks.md) - [Opera Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/opera-browsing-history.md) - [Opera Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/opera-cookies.md) - [Opera Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/opera-downloads.md) - [Opera Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/opera-extensions.md) - [Opera Favicons](/air/features/acquisition/acquisition-profiles/windows-collections/opera-favicons.md) - [Opera Form History](/air/features/acquisition/acquisition-profiles/windows-collections/opera-form-history.md) - [Opera Local Storage](/air/features/acquisition/acquisition-profiles/windows-collections/opera-local-storage.md) - [Opera Login Data](/air/features/acquisition/acquisition-profiles/windows-collections/opera-login-data.md) - [Opera Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/opera-sessions.md) - [Opera Thumbnails](/air/features/acquisition/acquisition-profiles/windows-collections/opera-thumbnails.md) - [Opera User Profiles](/air/features/acquisition/acquisition-profiles/windows-collections/opera-user-profiles.md) - [Opera Web Storage](/air/features/acquisition/acquisition-profiles/windows-collections/opera-web-storage.md) - [Page File](/air/features/acquisition/acquisition-profiles/windows-collections/page-file.md) - [Palo Alto Logs](/air/features/acquisition/acquisition-profiles/windows-collections/palo-alto-logs.md) - [Parse LNK Files](/air/features/acquisition/acquisition-profiles/windows-collections/parse-lnk-files.md) - [Parse SRUM Application Timeline](/air/features/acquisition/acquisition-profiles/windows-collections/parse-srum-application-timeline.md) - [Parse SRUM Application Usage](/air/features/acquisition/acquisition-profiles/windows-collections/parse-srum-application-usage.md) - [Parse SRUM Energy Usage](/air/features/acquisition/acquisition-profiles/windows-collections/parse-srum-energy-usage.md) - [Parse SRUM Network Connectivity](/air/features/acquisition/acquisition-profiles/windows-collections/parse-srum-network-connectivity.md) - [Parse SRUM Network Usage](/air/features/acquisition/acquisition-profiles/windows-collections/parse-srum-network-usage.md) - [PDB Information](/air/features/acquisition/acquisition-profiles/windows-collections/pdb-information.md) - [Powershell](/air/features/acquisition/acquisition-profiles/windows-collections/powershell-logs.md) - [Powershell ConsoleHost History](/air/features/acquisition/acquisition-profiles/windows-collections/powershell-consolehost-history.md) - [Prefetch Files](/air/features/acquisition/acquisition-profiles/windows-collections/prefetch-files.md) - [Processes and Modules](/air/features/acquisition/acquisition-profiles/windows-collections/running-processes-and-modules.md) - [Proxy List](/air/features/acquisition/acquisition-profiles/windows-collections/proxy-list.md) - [QQ Bookmarks](/air/features/acquisition/acquisition-profiles/windows-collections/qq-bookmarks.md) - [QQ Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/qq-browsing-history.md) - [QQ Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/qq-cookies.md) - [QQ Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/qq-downloads.md) - [QQ Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/qq-extensions.md) - [QQ Favicons](/air/features/acquisition/acquisition-profiles/windows-collections/qq-favicons.md) - [QQ Form History](/air/features/acquisition/acquisition-profiles/windows-collections/qq-form-history.md) - [QQ Local Storage](/air/features/acquisition/acquisition-profiles/windows-collections/qq-local-storage.md) - [QQ Login Data](/air/features/acquisition/acquisition-profiles/windows-collections/qq-login-data.md) - [QQ Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/qq-sessions.md) - [QQ Thumbnails](/air/features/acquisition/acquisition-profiles/windows-collections/qq-thumbnails.md) - [QQ User Profiles](/air/features/acquisition/acquisition-profiles/windows-collections/qq-user-profiles.md) - [QQ Web Storage](/air/features/acquisition/acquisition-profiles/windows-collections/qq-web-storage.md) - [Quick Assist](/air/features/acquisition/acquisition-profiles/windows-collections/quick-assist.md) - [RAM Image](/air/features/acquisition/acquisition-profiles/windows-collections/ram-image.md) - [RDP Cache Files](/air/features/acquisition/acquisition-profiles/windows-collections/rdp-cache.md) - [RealVNC Logs](/air/features/acquisition/acquisition-profiles/windows-collections/realvnc-logs.md) - [RecentDocs](/air/features/acquisition/acquisition-profiles/windows-collections/recentdocs.md) - [RecentFileCache.bcf](/air/features/acquisition/acquisition-profiles/windows-collections/recent-file-cache.md) - [Recycle Bin Information](/air/features/acquisition/acquisition-profiles/windows-collections/recycle-bin-information.md) - [Registry Hives](/air/features/acquisition/acquisition-profiles/windows-collections/registry-hives.md) - [Registry Items](/air/features/acquisition/acquisition-profiles/windows-collections/registry-items.md) - [RemComSvc Logs](/air/features/acquisition/acquisition-profiles/windows-collections/remcomsvc-logs.md) - [Remote Utilities Logs](/air/features/acquisition/acquisition-profiles/windows-collections/remote-utilities-logs.md) - [RogueKiller Reports](/air/features/acquisition/acquisition-profiles/windows-collections/roguekiller-reports.md) - [RunMRU](/air/features/acquisition/acquisition-profiles/windows-collections/runmru.md) - [SAM Collector](/air/features/acquisition/acquisition-profiles/windows-collections/sam-users-and-groups.md) - [Scheduled Tasks](/air/features/acquisition/acquisition-profiles/windows-collections/scheduled-tasks.md) - [ScreenConnect (ConnectWise Control) Application Data](/air/features/acquisition/acquisition-profiles/windows-collections/screenconnect-connectwise-control-application-data.md) - [Search History](/air/features/acquisition/acquisition-profiles/windows-collections/search-history.md) - [SentinelOne Logs](/air/features/acquisition/acquisition-profiles/windows-collections/sentinelone-logs.md) - [Service List](/air/features/acquisition/acquisition-profiles/windows-collections/service-list.md) - [Shadow Copy as CSV](/air/features/acquisition/acquisition-profiles/windows-collections/shadow-copy-as-csv.md) - [ShellBags](/air/features/acquisition/acquisition-profiles/windows-collections/shellbags.md) - [ShellFolders](/air/features/acquisition/acquisition-profiles/windows-collections/shellfolders.md) - [Shim Database](/air/features/acquisition/acquisition-profiles/windows-collections/sdb.md) - [Skype Databases](/air/features/acquisition/acquisition-profiles/windows-collections/skype-databases.md) - [Skype Media](/air/features/acquisition/acquisition-profiles/windows-collections/skype-media.md) - [Sophos Logs](/air/features/acquisition/acquisition-profiles/windows-collections/sophos-logs.md) - [Sourcefire FireAMP Logs](/air/features/acquisition/acquisition-profiles/windows-collections/sourcefire-fireamp-logs.md) - [Splashtop Logs](/air/features/acquisition/acquisition-profiles/windows-collections/splashtop-logs.md) - [Spotify Cache](/air/features/acquisition/acquisition-profiles/windows-collections/spotify-cache.md) - [Spotify Recently Played List](/air/features/acquisition/acquisition-profiles/windows-collections/spotify-recently-played-list.md) - [SRUM](/air/features/acquisition/acquisition-profiles/windows-collections/srum.md) - [Startup Items](/air/features/acquisition/acquisition-profiles/windows-collections/startup-items.md) - [Sublime Text Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/sublime-text-sessions.md) - [SUPERAntiSpyware Logs](/air/features/acquisition/acquisition-profiles/windows-collections/superantispyware-logs.md) - [Superfetch](/air/features/acquisition/acquisition-profiles/windows-collections/superfetch.md) - [Supremo Remote Desktop Logs](/air/features/acquisition/acquisition-profiles/windows-collections/supremo-remote-desktop-logs.md) - [Swap File](/air/features/acquisition/acquisition-profiles/windows-collections/swap-file.md) - [Symantec Logs](/air/features/acquisition/acquisition-profiles/windows-collections/symantec-logs.md) - [System Restore Points Information](/air/features/acquisition/acquisition-profiles/windows-collections/system-restore-points-information.md) - [Tanium Logs](/air/features/acquisition/acquisition-profiles/windows-collections/tanium-logs.md) - [TCP Table](/air/features/acquisition/acquisition-profiles/windows-collections/tcp-table.md) - [TeamViewer Logs](/air/features/acquisition/acquisition-profiles/windows-collections/teamviewer-logs.md) - [Telegram Desktop Data](/air/features/acquisition/acquisition-profiles/windows-collections/telegram-desktop-data.md) - [Telegram Desktop Download](/air/features/acquisition/acquisition-profiles/windows-collections/telegram-desktop-download.md) - [Thumbcache](/air/features/acquisition/acquisition-profiles/windows-collections/thumbcache.md) - [TightVNC Logs](/air/features/acquisition/acquisition-profiles/windows-collections/tightvnc-logs.md) - [Tortoise Git Logs](/air/features/acquisition/acquisition-profiles/windows-collections/tortoise-git-logs.md) - [TotalAv Logs](/air/features/acquisition/acquisition-profiles/windows-collections/totalav-logs.md) - [Trend Micro Logs](/air/features/acquisition/acquisition-profiles/windows-collections/trend-micro-logs.md) - [Twitter Cache](/air/features/acquisition/acquisition-profiles/windows-collections/twitter-cache.md) - [Twitter Databases](/air/features/acquisition/acquisition-profiles/windows-collections/twitter-databases.md) - [TypedPaths](/air/features/acquisition/acquisition-profiles/windows-collections/typedpaths.md) - [TypedURLs](/air/features/acquisition/acquisition-profiles/windows-collections/typedurls.md) - [UDP Table](/air/features/acquisition/acquisition-profiles/windows-collections/udp-table.md) - [Ultraviewer Logs](/air/features/acquisition/acquisition-profiles/windows-collections/ultraviewer-logs.md) - [UltraVNC Logs](/air/features/acquisition/acquisition-profiles/windows-collections/ultravnc-logs.md) - [USB Storage History](/air/features/acquisition/acquisition-profiles/windows-collections/usb-storage-history.md) - [User Access Logs](/air/features/acquisition/acquisition-profiles/windows-collections/user-access-logs-ual.md) - [User Folders](/air/features/acquisition/acquisition-profiles/windows-collections/user-folders.md) - [UserAssist](/air/features/acquisition/acquisition-profiles/windows-collections/userassist.md) - [Users](/air/features/acquisition/acquisition-profiles/windows-collections/users.md) - [USN Journal](/air/features/acquisition/acquisition-profiles/windows-collections/usn-journal-as-csv.md) - [USN Journal $Max](/air/features/acquisition/acquisition-profiles/windows-collections/usn-journal-max.md) - [USN Journal as CSV](/air/features/acquisition/acquisition-profiles/windows-collections/usn-journal.md) - [VIPRE Logs](/air/features/acquisition/acquisition-profiles/windows-collections/vipre-logs.md) - [Visual Studio Team Explorer Config](/air/features/acquisition/acquisition-profiles/windows-collections/visual-studio-team-explorer-config.md) - [Vivaldi Bookmarks](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-bookmarks.md) - [Vivaldi Browsing History](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-browsing-history.md) - [Vivaldi Cookies](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-cookies.md) - [Vivaldi Downloads](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-downloads.md) - [Vivaldi Extensions](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-extensions.md) - [Vivaldi Favicons](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-favicons.md) - [Vivaldi Form History](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-form-history.md) - [Vivaldi Local Storage](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-local-storage.md) - [Vivaldi Login Data](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-login-data.md) - [Vivaldi Sessions](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-sessions.md) - [Vivaldi Thumbnails](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-thumbnails.md) - [Vivaldi User Profiles](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-user-profiles.md) - [Vivaldi Web Storage](/air/features/acquisition/acquisition-profiles/windows-collections/vivaldi-web-storage.md) - [VMware Config](/air/features/acquisition/acquisition-profiles/windows-collections/vmware-config.md) - [VMware Drag and Drop Files](/air/features/acquisition/acquisition-profiles/windows-collections/vmware-drag-and-drop-files.md) - [VMware Logs](/air/features/acquisition/acquisition-profiles/windows-collections/vmware-logs.md) - [Volumes Information](/air/features/acquisition/acquisition-profiles/windows-collections/volumes-information.md) - [WBEM](/air/features/acquisition/acquisition-profiles/windows-collections/wbem.md) - [Webroot Logs](/air/features/acquisition/acquisition-profiles/windows-collections/webroot-logs.md) - [WhatsApp Desktop Cache](/air/features/acquisition/acquisition-profiles/windows-collections/whatsapp-desktop-cache.md) - [WhatsApp Desktop Cookie](/air/features/acquisition/acquisition-profiles/windows-collections/whatsapp-desktop-cookie.md) - [Windows Defender Logs](/air/features/acquisition/acquisition-profiles/windows-collections/windows-defender-logs.md) - [Windows Error Reporting Files](/air/features/acquisition/acquisition-profiles/windows-collections/windows-error-reporting-files.md) - [Windows Index Search](/air/features/acquisition/acquisition-profiles/windows-collections/windows-index-search.md) - [Windows Live Mail User Settings](/air/features/acquisition/acquisition-profiles/windows-collections/windows-live-mail-user-settings.md) - [Windows Notification History](/air/features/acquisition/acquisition-profiles/windows-collections/windows-notification-history.md) - [Windows Timeline](/air/features/acquisition/acquisition-profiles/windows-collections/windows-timeline.md) - [Winrar History](/air/features/acquisition/acquisition-profiles/windows-collections/winrar-history.md) - [Wireless Connection History](/air/features/acquisition/acquisition-profiles/windows-collections/wireless-connection-history.md) - [WordWheelQuery](/air/features/acquisition/acquisition-profiles/windows-collections/wordwheelquery.md) - [WSL](/air/features/acquisition/acquisition-profiles/windows-collections/wsl.md) - [Xeox Logs](/air/features/acquisition/acquisition-profiles/windows-collections/xeox-logs.md) - [ZohoAssist Logs](/air/features/acquisition/acquisition-profiles/windows-collections/zohoassist-logs.md) - [Zoom Databases](/air/features/acquisition/acquisition-profiles/windows-collections/zoom-databases.md) - [Zoom Media](/air/features/acquisition/acquisition-profiles/windows-collections/zoom-media.md) - [macOS Collections](/air/features/acquisition/acquisition-profiles/macos-collections.md): AIR supports the following macOS Evidences - [AnyDesk Logs](/air/features/acquisition/acquisition-profiles/macos-collections/anydesk-logs.md) - [Apache Logs](/air/features/acquisition/acquisition-profiles/macos-collections/apache-logs.md) - [Apple Audit Logs](/air/features/acquisition/acquisition-profiles/macos-collections/apple-audit-logs.md) - [Apple System Logs (ASL)](/air/features/acquisition/acquisition-profiles/macos-collections/apple-system-logs-asl.md) - [Application Usage](/air/features/acquisition/acquisition-profiles/macos-collections/application-usage.md) - [Arc Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/arc-bookmarks.md) - [Arc Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/arc-browsing-history.md) - [Arc Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/arc-cookies.md) - [Arc Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/arc-downloads.md) - [Arc Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/arc-favicons.md) - [Arc Form History](/air/features/acquisition/acquisition-profiles/macos-collections/arc-form-history.md) - [Arc Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/arc-local-storage.md) - [Arc Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/arc-login-data.md) - [Arc Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/arc-sessions.md) - [Arc Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/arc-thumbnails.md) - [Arc User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/arc-user-profiles.md) - [Arc Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/arc-web-storage.md) - [Auto Loaded Processes](/air/features/acquisition/acquisition-profiles/macos-collections/auto-loaded-processes.md) - [Block Devices](/air/features/acquisition/acquisition-profiles/macos-collections/block-devices.md) - [Bluetooth Connections](/air/features/acquisition/acquisition-profiles/macos-collections/bluetooth-connections.md) - [Brave Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/brave-bookmarks.md) - [Brave Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/brave-browsing-history.md) - [Brave Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/brave-cookies.md) - [Brave Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/brave-downloads.md) - [Brave Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/brave-favicons.md) - [Brave Form History](/air/features/acquisition/acquisition-profiles/macos-collections/brave-form-history.md) - [Brave Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/brave-local-storage.md) - [Brave Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/brave-login-data.md) - [Brave Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/brave-sessions.md) - [Brave Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/brave-thumbnails.md) - [Brave User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/brave-user-profiles.md) - [Brave Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/brave-web-storage.md) - [Chrome Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-bookmarks.md) - [Chrome Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-browsing-history.md) - [Chrome Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-cookies.md) - [Chrome Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-downloads.md) - [Chrome Extensions](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-extensions.md) - [Chrome Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-favicons.md) - [Chrome Form History](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-form-history.md) - [Chrome Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-local-storage.md) - [Chrome Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-login-data.md) - [Chrome Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-sessions.md) - [Chrome Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-thumbnails.md) - [Chrome User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-user-profiles.md) - [Chrome Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/chrome-web-storage.md) - [Command Line Activity](/air/features/acquisition/acquisition-profiles/macos-collections/command-line-activity.md) - [Crashes](/air/features/acquisition/acquisition-profiles/macos-collections/crashes.md) - [Cron Jobs](/air/features/acquisition/acquisition-profiles/macos-collections/cron-jobs.md) - [Default Browser](/air/features/acquisition/acquisition-profiles/macos-collections/default-browser.md) - [DHCP Settings](/air/features/acquisition/acquisition-profiles/macos-collections/dhcp-settings.md) - [Discord Desktop Cache](/air/features/acquisition/acquisition-profiles/macos-collections/discord-desktop-cache.md) - [Disk Encryption](/air/features/acquisition/acquisition-profiles/macos-collections/disk-encryption.md) - [DMG File Opened](/air/features/acquisition/acquisition-profiles/macos-collections/dmg-file-opened.md) - [DNS Resolvers](/air/features/acquisition/acquisition-profiles/macos-collections/dns-resolvers.md) - [Dock Items](/air/features/acquisition/acquisition-profiles/macos-collections/dock-items.md) - [Docker Changes](/air/features/acquisition/acquisition-profiles/macos-collections/docker-changes.md) - [Docker Container Logs](/air/features/acquisition/acquisition-profiles/macos-collections/docker-container-logs.md) - [Docker Containers](/air/features/acquisition/acquisition-profiles/macos-collections/docker-containers.md) - [Docker Image History](/air/features/acquisition/acquisition-profiles/macos-collections/docker-image-history.md) - [Docker Images](/air/features/acquisition/acquisition-profiles/macos-collections/docker-images.md) - [Docker Info](/air/features/acquisition/acquisition-profiles/macos-collections/docker-info.md) - [Docker Logs](/air/features/acquisition/acquisition-profiles/macos-collections/docker-logs.md) - [Docker Networks](/air/features/acquisition/acquisition-profiles/macos-collections/docker-networks.md) - [Docker Processes](/air/features/acquisition/acquisition-profiles/macos-collections/docker-processes.md) - [Docker Volumes](/air/features/acquisition/acquisition-profiles/macos-collections/docker-volumes.md) - [Document Revisions](/air/features/acquisition/acquisition-profiles/macos-collections/document-revisions.md) - [Downloaded Files Information](/air/features/acquisition/acquisition-profiles/macos-collections/downloaded-files-information.md) - [.DS\_Store Files](/air/features/acquisition/acquisition-profiles/macos-collections/ds-store-files.md) - [Dump Arc Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-arc-indexed-db.md) - [Dump Brave Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-brave-indexed-db.md) - [Dump Chrome Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-chrome-indexed-db.md) - [Dump Edge Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-edge-indexed-db.md) - [Dump Opera Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-opera-indexed-db.md) - [Dump QQ Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-qq-indexed-db.md) - [Dump Vivaldi Indexed DB](/air/features/acquisition/acquisition-profiles/macos-collections/dump-vivaldi-indexed-db.md) - [Edge Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/edge-bookmarks.md) - [Edge Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/edge-browsing-history.md) - [Edge Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/edge-cookies.md) - [Edge Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/edge-downloads.md) - [Edge Extensions](/air/features/acquisition/acquisition-profiles/macos-collections/edge-extensions.md) - [Edge Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/edge-favicons.md) - [Edge Form History](/air/features/acquisition/acquisition-profiles/macos-collections/edge-form-history.md) - [Edge Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/edge-local-storage.md) - [Edge Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/edge-login-data.md) - [Edge Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/edge-sessions.md) - [Edge Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/edge-thumbnails.md) - [Edge User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/edge-user-profiles.md) - [Edge Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/edge-web-storage.md) - [Emond Clients](/air/features/acquisition/acquisition-profiles/macos-collections/emond-clients.md) - [Etc Files](/air/features/acquisition/acquisition-profiles/macos-collections/etc-files.md) - [Etc Hosts](/air/features/acquisition/acquisition-profiles/macos-collections/etc-hosts.md) - [Etc Protocols](/air/features/acquisition/acquisition-profiles/macos-collections/etc-protocols.md) - [Etc Services](/air/features/acquisition/acquisition-profiles/macos-collections/etc-services.md) - [Event Taps](/air/features/acquisition/acquisition-profiles/macos-collections/event-taps.md) - [Extended Attributes](/air/features/acquisition/acquisition-profiles/macos-collections/extended-attributes.md) - [Failed Sudo](/air/features/acquisition/acquisition-profiles/macos-collections/failed-sudo.md) - [File Last Used](/air/features/acquisition/acquisition-profiles/macos-collections/file-last-used.md) - [File System Enumeration](/air/features/acquisition/acquisition-profiles/macos-collections/file-system-enumeration.md) - [Finder Mounted Volume](/air/features/acquisition/acquisition-profiles/macos-collections/finder-mounted-volume.md) - [Firefox Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/firefox-browsing-history.md) - [Firefox Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/firefox-cookies.md) - [Firefox Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/firefox-downloads.md) - [Firefox Extensions](/air/features/acquisition/acquisition-profiles/macos-collections/firefox-extensions.md) - [Collect File System (FS) Events](/air/features/acquisition/acquisition-profiles/macos-collections/collect-file-system-fs-events.md) - [Parse File System (FS) Events](/air/features/acquisition/acquisition-profiles/macos-collections/parse-file-system-fs-events.md) - [Gatekeeper Approved Apps](/air/features/acquisition/acquisition-profiles/macos-collections/gatekeeper-approved-apps.md) - [Gatekeeper](/air/features/acquisition/acquisition-profiles/macos-collections/gatekeeper.md) - [Homebrew Logs](/air/features/acquisition/acquisition-profiles/macos-collections/homebrew-logs.md) - [iMessage](/air/features/acquisition/acquisition-profiles/macos-collections/imessage.md) - [Install Logs](/air/features/acquisition/acquisition-profiles/macos-collections/install-logs.md) - [Installed Applications](/air/features/acquisition/acquisition-profiles/macos-collections/installed-applications.md) - [IP Routes](/air/features/acquisition/acquisition-profiles/macos-collections/ip-routes.md) - [Kernel Extensions Info](/air/features/acquisition/acquisition-profiles/macos-collections/kernel-extensions-info.md) - [Kernel Extensions](/air/features/acquisition/acquisition-profiles/macos-collections/kernel-extensions.md) - [Keyboard Dictionary](/air/features/acquisition/acquisition-profiles/macos-collections/keyboard-dictionary.md) - [Keychain](/air/features/acquisition/acquisition-profiles/macos-collections/keychain.md) - [KnowledgeC](/air/features/acquisition/acquisition-profiles/macos-collections/knowledgec.md) - [Launchd Files](/air/features/acquisition/acquisition-profiles/macos-collections/launchd-files.md) - [Launchd Overrides](/air/features/acquisition/acquisition-profiles/macos-collections/launchd-overrides.md) - [Listening Ports](/air/features/acquisition/acquisition-profiles/macos-collections/listening-ports.md) - [Logged Users](/air/features/acquisition/acquisition-profiles/macos-collections/logged-users.md) - [Login Hooks](/air/features/acquisition/acquisition-profiles/macos-collections/login-hooks.md) - [Login Items](/air/features/acquisition/acquisition-profiles/macos-collections/login-items.md) - [logind](/air/features/acquisition/acquisition-profiles/macos-collections/logind.md) - [Logout Hooks](/air/features/acquisition/acquisition-profiles/macos-collections/logout-hooks.md) - [Mail Rules](/air/features/acquisition/acquisition-profiles/macos-collections/mail-rules.md) - [Manuel Configuration Profile Install](/air/features/acquisition/acquisition-profiles/macos-collections/manuel-configuration-profile-install.md) - [MongoDB Logs](/air/features/acquisition/acquisition-profiles/macos-collections/mongodb-logs.md) - [Most Recently Used](/air/features/acquisition/acquisition-profiles/macos-collections/most-recently-used-mru.md) - [Mount](/air/features/acquisition/acquisition-profiles/macos-collections/mount.md) - [MySQL Logs](/air/features/acquisition/acquisition-profiles/macos-collections/mysql-logs.md) - [Network Interfaces](/air/features/acquisition/acquisition-profiles/macos-collections/network-interfaces.md) - [Network Usage](/air/features/acquisition/acquisition-profiles/macos-collections/network-usage.md) - [NetworkFlow](/air/features/acquisition/acquisition-profiles/macos-collections/networkflow.md) - [NGINX Logs](/air/features/acquisition/acquisition-profiles/macos-collections/nginx-logs.md) - [Notification Info](/air/features/acquisition/acquisition-profiles/macos-collections/notification-info.md) - [Opera Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/opera-bookmarks.md) - [Opera Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/opera-browsing-history.md) - [Opera Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/opera-cookies.md) - [Opera Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/opera-downloads.md) - [Opera Extensions](/air/features/acquisition/acquisition-profiles/macos-collections/opera-extensions.md) - [Opera Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/opera-favicons.md) - [Opera Form History](/air/features/acquisition/acquisition-profiles/macos-collections/opera-form-history.md) - [Opera Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/opera-local-storage.md) - [Opera Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/opera-login-data.md) - [Opera Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/opera-sessions.md) - [Opera Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/opera-thumbnails.md) - [Opera User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/opera-user-profiles.md) - [Opera Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/opera-web-storage.md) - [PCAP](/air/features/acquisition/acquisition-profiles/macos-collections/pcap.md) - [Package Install History](/air/features/acquisition/acquisition-profiles/macos-collections/package-install-history.md) - [Parallels Logs](/air/features/acquisition/acquisition-profiles/macos-collections/parallels-logs.md) - [PostgreSQL Logs](/air/features/acquisition/acquisition-profiles/macos-collections/postgresql-logs.md) - [Print Jobs](/air/features/acquisition/acquisition-profiles/macos-collections/print-jobs.md) - [Printer Info](/air/features/acquisition/acquisition-profiles/macos-collections/printer-info.md) - [Processes](/air/features/acquisition/acquisition-profiles/macos-collections/processes.md) - [QQ Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/qq-bookmarks.md) - [QQ Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/qq-browsing-history.md) - [QQ Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/qq-cookies.md) - [QQ Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/qq-downloads.md) - [QQ Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/qq-favicons.md) - [QQ Form History](/air/features/acquisition/acquisition-profiles/macos-collections/qq-form-history.md) - [QQ Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/qq-local-storage.md) - [QQ Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/qq-login-data.md) - [QQ Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/qq-sessions.md) - [QQ Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/qq-thumbnails.md) - [QQ User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/qq-user-profiles.md) - [QQ Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/qq-web-storage.md) - [Quarantine Events](/air/features/acquisition/acquisition-profiles/macos-collections/quarantine-events.md) - [Quick Look Cache](/air/features/acquisition/acquisition-profiles/macos-collections/quick-look-cache.md) - [Re-opened Apps](/air/features/acquisition/acquisition-profiles/macos-collections/re-opened-apps.md) - [Safari Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/safari-browsing-history.md) - [Safari Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/safari-downloads.md) - [ScreenSharing](/air/features/acquisition/acquisition-profiles/macos-collections/screensharing.md) - [Session Creation and Destruction](/air/features/acquisition/acquisition-profiles/macos-collections/session-creation-and-destruction.md) - [Shared File List](/air/features/acquisition/acquisition-profiles/macos-collections/shared-file-list.md) - [Shell History](/air/features/acquisition/acquisition-profiles/macos-collections/shell-history.md) - [Software Update Information](/air/features/acquisition/acquisition-profiles/macos-collections/software-update-information.md) - [Sophos Events Database](/air/features/acquisition/acquisition-profiles/macos-collections/sophos-events-database.md) - [Sophos Logs](/air/features/acquisition/acquisition-profiles/macos-collections/sophos-logs.md) - [Splashtop Mac Logs](/air/features/acquisition/acquisition-profiles/macos-collections/splashtop-mac-logs.md) - [Spotlight Metadata](/air/features/acquisition/acquisition-profiles/macos-collections/spotlight-metadata.md) - [SSH Authorized Keys](/air/features/acquisition/acquisition-profiles/macos-collections/ssh-authorized-keys.md) - [SSH Configs](/air/features/acquisition/acquisition-profiles/macos-collections/ssh-configs.md) - [SSH Files](/air/features/acquisition/acquisition-profiles/macos-collections/ssh-files.md) - [SSH Known Hosts](/air/features/acquisition/acquisition-profiles/macos-collections/ssh-known-hosts.md) - [SSHD Configs](/air/features/acquisition/acquisition-profiles/macos-collections/sshd-configs.md) - [SSHD](/air/features/acquisition/acquisition-profiles/macos-collections/sshd.md) - [Sudo Last Run](/air/features/acquisition/acquisition-profiles/macos-collections/sudo-last-run.md) - [System Extension Info](/air/features/acquisition/acquisition-profiles/macos-collections/system-extension-info.md) - [System Integrity Protection Status](/air/features/acquisition/acquisition-profiles/macos-collections/system-integrity-protection-status.md) - [System Logs](/air/features/acquisition/acquisition-profiles/macos-collections/system-logs.md) - [TCCD](/air/features/acquisition/acquisition-profiles/macos-collections/tccd.md) - [TeamViewer Logs](/air/features/acquisition/acquisition-profiles/macos-collections/teamviewer-logs.md) - [Transparency, Consent, and Control (TCC)](/air/features/acquisition/acquisition-profiles/macos-collections/transparency-consent-and-control-tcc.md) - [.Trash](/air/features/acquisition/acquisition-profiles/macos-collections/trash.md) - [USB Info](/air/features/acquisition/acquisition-profiles/macos-collections/usb-info.md) - [User Groups](/air/features/acquisition/acquisition-profiles/macos-collections/user-groups.md) - [Users](/air/features/acquisition/acquisition-profiles/macos-collections/users.md) - [Vivaldi Bookmarks](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-bookmarks.md) - [Vivaldi Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-browsing-history.md) - [Vivaldi Cookies](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-cookies.md) - [Vivaldi Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-downloads.md) - [Vivaldi Favicons](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-favicons.md) - [Vivaldi Form History](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-form-history.md) - [Vivaldi Local Storage](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-local-storage.md) - [Vivaldi Login Data](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-login-data.md) - [Vivaldi Sessions](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-sessions.md) - [Vivaldi Thumbnails](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-thumbnails.md) - [Vivaldi User Profiles](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-user-profiles.md) - [Vivaldi Web Storage](/air/features/acquisition/acquisition-profiles/macos-collections/vivaldi-web-storage.md) - [Waterfox Browsing History](/air/features/acquisition/acquisition-profiles/macos-collections/waterfox-browsing-history.md) - [Waterfox Downloads](/air/features/acquisition/acquisition-profiles/macos-collections/waterfox-downloads.md) - [WiFi Logs](/air/features/acquisition/acquisition-profiles/macos-collections/wifi-logs.md) - [Wireless Network Connections](/air/features/acquisition/acquisition-profiles/macos-collections/wireless-network-connections.md) - [XProtect Remediation](/air/features/acquisition/acquisition-profiles/macos-collections/xprotect-remediation.md) - [Linux Collections](/air/features/acquisition/acquisition-profiles/linux-collections.md): AIR supports the following Linux Evidences - [AnyDesk Logs](/air/features/acquisition/acquisition-profiles/linux-collections/anydesk-logs.md) - [Apache Logs](/air/features/acquisition/acquisition-profiles/linux-collections/apache-logs.md) - [AppArmor Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/apparmor-profiles.md) - [APT History](/air/features/acquisition/acquisition-profiles/linux-collections/apt-history.md) - [APT Sources](/air/features/acquisition/acquisition-profiles/linux-collections/apt-sources.md) - [ARP Table](/air/features/acquisition/acquisition-profiles/linux-collections/arp-table.md) - [Auth Logs](/air/features/acquisition/acquisition-profiles/linux-collections/auth-logs.md) - [Block Devices](/air/features/acquisition/acquisition-profiles/linux-collections/block-devices.md) - [Boot Logs](/air/features/acquisition/acquisition-profiles/linux-collections/boot-logs.md) - [Brave Bookmarks](/air/features/acquisition/acquisition-profiles/linux-collections/brave-bookmarks.md) - [Brave Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/brave-browsing-history.md) - [Brave Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/brave-cookies.md) - [Brave Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/brave-downloads.md) - [Brave Favicons](/air/features/acquisition/acquisition-profiles/linux-collections/brave-favicons.md) - [Brave Form History](/air/features/acquisition/acquisition-profiles/linux-collections/brave-form-history.md) - [Brave Local Storage](/air/features/acquisition/acquisition-profiles/linux-collections/brave-local-storage.md) - [Brave Login Data](/air/features/acquisition/acquisition-profiles/linux-collections/brave-login-data.md) - [Brave Sessions](/air/features/acquisition/acquisition-profiles/linux-collections/brave-sessions.md) - [Brave Thumbnails](/air/features/acquisition/acquisition-profiles/linux-collections/brave-thumbnails.md) - [Brave User Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/brave-user-profiles.md) - [Brave Web Storage](/air/features/acquisition/acquisition-profiles/linux-collections/brave-web-storage.md) - [Chrome Bookmarks](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-bookmarks.md) - [Chrome Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-browsing-history.md) - [Chrome Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-cookies.md) - [Chrome Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-downloads.md) - [Chrome Extensions](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-extensions.md) - [Chrome Favicons](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-favicons.md) - [Chrome Form History](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-form-history.md) - [Chrome Local Storage](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-local-storage.md) - [Chrome Login Data](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-login-data.md) - [Chrome Sessions](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-sessions.md) - [Chrome Thumbnails](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-thumbnails.md) - [Chrome User Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-user-profiles.md) - [Chrome Web Storage](/air/features/acquisition/acquisition-profiles/linux-collections/chrome-web-storage.md) - [Chromium Bookmarks](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-bookmarks.md) - [Chromium Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-browsing-history.md) - [Chromium Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-cookies.md) - [Chromium Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-downloads.md) - [Chromium Favicons](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-favicons.md) - [Chromium Form History](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-form-history.md) - [Chromium Local Storage](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-local-storage.md) - [Chromium Login Data](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-login-data.md) - [Chromium Sessions](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-sessions.md) - [Chromium Thumbnails](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-thumbnails.md) - [Chromium User Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-user-profiles.md) - [Chromium Web Storage](/air/features/acquisition/acquisition-profiles/linux-collections/chromium-web-storage.md) - [Cron Jobs](/air/features/acquisition/acquisition-profiles/linux-collections/cron-jobs.md) - [DEB Packages](/air/features/acquisition/acquisition-profiles/linux-collections/deb-packages.md) - [Default Browser](/air/features/acquisition/acquisition-profiles/linux-collections/default-browser.md) - [DHCP Server Logs](/air/features/acquisition/acquisition-profiles/linux-collections/dhcp-server-logs.md) - [DNF History](/air/features/acquisition/acquisition-profiles/linux-collections/dnf-history.md) - [DNS Resolvers](/air/features/acquisition/acquisition-profiles/linux-collections/dns-resolvers.md) - [Docker Changes](/air/features/acquisition/acquisition-profiles/linux-collections/docker-changes.md) - [Docker Container Logs](/air/features/acquisition/acquisition-profiles/linux-collections/docker-container-logs.md) - [Docker Containers](/air/features/acquisition/acquisition-profiles/linux-collections/docker-containers.md) - [Docker Image History](/air/features/acquisition/acquisition-profiles/linux-collections/docker-image-history.md) - [Docker Images](/air/features/acquisition/acquisition-profiles/linux-collections/docker-images.md) - [Docker Info](/air/features/acquisition/acquisition-profiles/linux-collections/docker-info.md) - [Docker Logs](/air/features/acquisition/acquisition-profiles/linux-collections/docker-logs.md) - [Docker Networks](/air/features/acquisition/acquisition-profiles/linux-collections/docker-networks.md) - [Docker Processes](/air/features/acquisition/acquisition-profiles/linux-collections/docker-processes.md) - [Docker Volumes](/air/features/acquisition/acquisition-profiles/linux-collections/docker-volumes.md) - [Dump Brave Indexed DB](/air/features/acquisition/acquisition-profiles/linux-collections/dump-brave-indexed-db.md) - [Dump Chrome Indexed DB](/air/features/acquisition/acquisition-profiles/linux-collections/dump-chrome-indexed-db.md) - [Dump Chromium Indexed DB](/air/features/acquisition/acquisition-profiles/linux-collections/dump-chromium-indexed-db.md) - [Dump Edge Indexed DB](/air/features/acquisition/acquisition-profiles/linux-collections/dump-edge-indexed-db.md) - [Dump Opera Indexed DB](/air/features/acquisition/acquisition-profiles/linux-collections/dump-opera-indexed-db.md) - [Dump Vivaldi Indexed DB](/air/features/acquisition/acquisition-profiles/linux-collections/dump-vivaldi-indexed-db.md) - [Edge Bookmarks](/air/features/acquisition/acquisition-profiles/linux-collections/edge-bookmarks.md) - [Edge Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/edge-browsing-history.md) - [Edge Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/edge-cookies.md) - [Edge Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/edge-downloads.md) - [Edge Favicons](/air/features/acquisition/acquisition-profiles/linux-collections/edge-favicons.md) - [Edge Form History](/air/features/acquisition/acquisition-profiles/linux-collections/edge-form-history.md) - [Edge Local Storage](/air/features/acquisition/acquisition-profiles/linux-collections/edge-local-storage.md) - [Edge Login Data](/air/features/acquisition/acquisition-profiles/linux-collections/edge-login-data.md) - [Edge Sessions](/air/features/acquisition/acquisition-profiles/linux-collections/edge-sessions.md) - [Edge Thumbnails](/air/features/acquisition/acquisition-profiles/linux-collections/edge-thumbnails.md) - [Edge User Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/edge-user-profiles.md) - [Edge Web Storage](/air/features/acquisition/acquisition-profiles/linux-collections/edge-web-storage.md) - [Etc Files](/air/features/acquisition/acquisition-profiles/linux-collections/etc-files.md) - [Failed Login Attempts](/air/features/acquisition/acquisition-profiles/linux-collections/failed-login-attempts.md) - [File System Enumeration as CSV](/air/features/acquisition/acquisition-profiles/linux-collections/file-system-enumeration-as-csv.md) - [Firefox Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/firefox-browsing-history.md) - [Firefox Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/firefox-cookies.md) - [Firefox Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/firefox-downloads.md) - [Firefox Extensions](/air/features/acquisition/acquisition-profiles/linux-collections/firefox-extensions.md) - [Fstab](/air/features/acquisition/acquisition-profiles/linux-collections/fstab.md) - [Hosts](/air/features/acquisition/acquisition-profiles/linux-collections/hosts.md) - [ICMP Table](/air/features/acquisition/acquisition-profiles/linux-collections/icmp-table.md) - [IP Routes](/air/features/acquisition/acquisition-profiles/linux-collections/ip-routes.md) - [IP Tables](/air/features/acquisition/acquisition-profiles/linux-collections/ip-tables.md) - [Kernel Logs](/air/features/acquisition/acquisition-profiles/linux-collections/kernel-logs.md) - [Kernel Modules](/air/features/acquisition/acquisition-profiles/linux-collections/kernel-modules.md) - [Last Access](/air/features/acquisition/acquisition-profiles/linux-collections/last-access.md) - [Lock Files](/air/features/acquisition/acquisition-profiles/linux-collections/lock-files.md) - [Log Files](/air/features/acquisition/acquisition-profiles/linux-collections/log-files.md) - [Logged Users](/air/features/acquisition/acquisition-profiles/linux-collections/logged-users.md) - [Mail Logs](/air/features/acquisition/acquisition-profiles/linux-collections/mail-logs.md) - [Memory Map](/air/features/acquisition/acquisition-profiles/linux-collections/memory-map.md) - [Messages](/air/features/acquisition/acquisition-profiles/linux-collections/messages.md) - [MongoDB Logs](/air/features/acquisition/acquisition-profiles/linux-collections/mongodb-logs.md) - [Mounts](/air/features/acquisition/acquisition-profiles/linux-collections/mounts.md) - [MySQL Logs](/air/features/acquisition/acquisition-profiles/linux-collections/mysql-logs.md) - [Network Interfaces](/air/features/acquisition/acquisition-profiles/linux-collections/network-interfaces.md) - [NFS Exports](/air/features/acquisition/acquisition-profiles/linux-collections/nfs-exports.md) - [NGINX Logs](/air/features/acquisition/acquisition-profiles/linux-collections/nginx-logs.md) - [Opera Bookmarks](/air/features/acquisition/acquisition-profiles/linux-collections/opera-bookmarks.md) - [Opera Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/opera-browsing-history.md) - [Opera Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/opera-cookies.md) - [Opera Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/opera-downloads.md) - [Opera Favicons](/air/features/acquisition/acquisition-profiles/linux-collections/opera-favicons.md) - [Opera Form History](/air/features/acquisition/acquisition-profiles/linux-collections/opera-form-history.md) - [Opera Local Storage](/air/features/acquisition/acquisition-profiles/linux-collections/opera-local-storage.md) - [Opera Login Data](/air/features/acquisition/acquisition-profiles/linux-collections/opera-login-data.md) - [Opera Sessions](/air/features/acquisition/acquisition-profiles/linux-collections/opera-sessions.md) - [Opera Thumbnails](/air/features/acquisition/acquisition-profiles/linux-collections/opera-thumbnails.md) - [Opera User Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/opera-user-profiles.md) - [Opera Web Storage](/air/features/acquisition/acquisition-profiles/linux-collections/opera-web-storage.md) - [PostgreSQL Logs](/air/features/acquisition/acquisition-profiles/linux-collections/postgresql-logs.md) - [Process Open Files](/air/features/acquisition/acquisition-profiles/linux-collections/process-open-files.md) - [Processes](/air/features/acquisition/acquisition-profiles/linux-collections/processes.md) - [RAM Image](/air/features/acquisition/acquisition-profiles/linux-collections/ram-image.md) - [Raw Table](/air/features/acquisition/acquisition-profiles/linux-collections/raw-table.md) - [Secure](/air/features/acquisition/acquisition-profiles/linux-collections/secure.md) - [SELinux Configs](/air/features/acquisition/acquisition-profiles/linux-collections/selinux-configs.md) - [SELinux Settings](/air/features/acquisition/acquisition-profiles/linux-collections/selinux-settings.md) - [Shadow](/air/features/acquisition/acquisition-profiles/linux-collections/shadow.md) - [Shared Memory](/air/features/acquisition/acquisition-profiles/linux-collections/shared-memory.md) - [Shell History](/air/features/acquisition/acquisition-profiles/linux-collections/shell-history.md) - [SSH Authorized Keys](/air/features/acquisition/acquisition-profiles/linux-collections/ssh-authorized-keys.md) - [SSH Configs](/air/features/acquisition/acquisition-profiles/linux-collections/ssh-configs.md) - [SSH Files](/air/features/acquisition/acquisition-profiles/linux-collections/ssh-files.md) - [SSH Known Hosts](/air/features/acquisition/acquisition-profiles/linux-collections/ssh-known-hosts.md) - [SSH Server Logs](/air/features/acquisition/acquisition-profiles/linux-collections/ssh-server-logs.md) - [SSHD Configs](/air/features/acquisition/acquisition-profiles/linux-collections/sshd-configs.md) - [Sudoers](/air/features/acquisition/acquisition-profiles/linux-collections/sudoers.md) - [SUID Binaries](/air/features/acquisition/acquisition-profiles/linux-collections/suid-binaries.md) - [Swaps](/air/features/acquisition/acquisition-profiles/linux-collections/swaps.md) - [Sysmon Logs](/air/features/acquisition/acquisition-profiles/linux-collections/sysmon-logs.md) - [System Artifacts](/air/features/acquisition/acquisition-profiles/linux-collections/system-artifacts.md) - [System Controls](/air/features/acquisition/acquisition-profiles/linux-collections/system-controls.md) - [System Logs](/air/features/acquisition/acquisition-profiles/linux-collections/system-logs.md) - [Systemctl Services](/air/features/acquisition/acquisition-profiles/linux-collections/systemctl-services.md) - [TCP Table](/air/features/acquisition/acquisition-profiles/linux-collections/tcp-table.md) - [UDP Table](/air/features/acquisition/acquisition-profiles/linux-collections/udp-table.md) - [UDPLite Table](/air/features/acquisition/acquisition-profiles/linux-collections/udplite-table.md) - [ULimit Information](/air/features/acquisition/acquisition-profiles/linux-collections/ulimit-information.md) - [Unix Sockets](/air/features/acquisition/acquisition-profiles/linux-collections/unix-sockets.md) - [User Groups](/air/features/acquisition/acquisition-profiles/linux-collections/user-groups.md) - [Users](/air/features/acquisition/acquisition-profiles/linux-collections/users.md) - [Vivaldi Bookmarks](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-bookmarks.md) - [Vivaldi Browsing History](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-browsing-history.md) - [Vivaldi Cookies](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-cookies.md) - [Vivaldi Downloads](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-downloads.md) - [Vivaldi Favicons](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-favicons.md) - [Vivaldi Form History](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-form-history.md) - [Vivaldi Local Storage](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-local-storage.md) - [Vivaldi Login Data](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-login-data.md) - [Vivaldi Sessions](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-sessions.md) - [Vivaldi Thumbnails](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-thumbnails.md) - [Vivaldi User Profiles](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-user-profiles.md) - [Vivaldi Web Storage](/air/features/acquisition/acquisition-profiles/linux-collections/vivaldi-web-storage.md) - [YUM History](/air/features/acquisition/acquisition-profiles/linux-collections/yum-history.md) - [YUM Sources](/air/features/acquisition/acquisition-profiles/linux-collections/yum-sources.md) - [IBM AIX Collections](/air/features/acquisition/acquisition-profiles/ibm-aix-collections.md): AIR supports the following AIX Evidences - [Auth Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/auth-logs.md) - [Boot Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/boot-logs.md) - [Cron Jobs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/cron-jobs.md) - [DHCP Server Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/dhcp-server-logs.md) - [DNS Resolvers](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/dns-resolvers.md) - [File System Enumeration](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/file-system-enumeration.md) - [Hosts](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/hosts.md) - [Log Files](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/log-files.md) - [Mail Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/mail-logs.md) - [Mounts](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/mounts.md) - [MySQL Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/mysql-logs.md) - [Processes](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/processes.md) - [SSH Authorized Keys](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/ssh-authorized-keys.md) - [SSH Configs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/ssh-configs.md) - [SSH Known Hosts](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/ssh-known-hosts.md) - [SSH Server Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/ssh-server-logs.md) - [SSHD Configs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/sshd-configs.md) - [SUID Binaries](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/suid-binaries.md) - [Shell History](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/shell-history.md) - [System Artifacts](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/system-artifacts.md) - [System Logs](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/system-logs.md) - [ULimit Information](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/ulimit-information.md) - [User Groups](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/user-groups.md) - [Users](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/users.md) - [YUM History](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/yum-history.md) - [YUM Sources](/air/features/acquisition/acquisition-profiles/ibm-aix-collections/yum-sources.md) - [ESXi Collections](/air/features/acquisition/acquisition-profiles/esxi-collections.md): AIR supports the following ESXi Evidences - [Account Info](/air/features/acquisition/acquisition-profiles/esxi-collections/account-info.md) - [Active Connections](/air/features/acquisition/acquisition-profiles/esxi-collections/active-connections.md) - [Advanced Configuration](/air/features/acquisition/acquisition-profiles/esxi-collections/advanced-configuration.md) - [Advanced Settings](/air/features/acquisition/acquisition-profiles/esxi-collections/advanced-settings.md) - [CollectInfo](/air/features/acquisition/acquisition-profiles/esxi-collections/collectinfo.md) - [CPU Info](/air/features/acquisition/acquisition-profiles/esxi-collections/cpu-info.md) - [Datastores](/air/features/acquisition/acquisition-profiles/esxi-collections/datastores.md) - [Disk Usage](/air/features/acquisition/acquisition-profiles/esxi-collections/disk-usage.md) - [Environment Variables](/air/features/acquisition/acquisition-profiles/esxi-collections/environment-variables.md) - [Filesystem Info](/air/features/acquisition/acquisition-profiles/esxi-collections/filesystem-info.md) - [Firewall Ruleset](/air/features/acquisition/acquisition-profiles/esxi-collections/firewall-ruleset.md) - [Hardware Clock Time](/air/features/acquisition/acquisition-profiles/esxi-collections/hardware-clock-time.md) - [Info](/air/features/acquisition/acquisition-profiles/esxi-collections/info.md) - [IP Interface Info](/air/features/acquisition/acquisition-profiles/esxi-collections/ip-interface-info.md) - [Kernel Info](/air/features/acquisition/acquisition-profiles/esxi-collections/kernel-info.md) - [Module List](/air/features/acquisition/acquisition-profiles/esxi-collections/module-list.md) - [Multipathing Info](/air/features/acquisition/acquisition-profiles/esxi-collections/multipathing-info.md) - [Networks](/air/features/acquisition/acquisition-profiles/esxi-collections/networks.md) - [NIC List](/air/features/acquisition/acquisition-profiles/esxi-collections/nic-list.md) - [Open Files](/air/features/acquisition/acquisition-profiles/esxi-collections/open-files.md) - [PCI Info](/air/features/acquisition/acquisition-profiles/esxi-collections/pci-info.md) - [Permission Info](/air/features/acquisition/acquisition-profiles/esxi-collections/permission-info.md) - [Processes](/air/features/acquisition/acquisition-profiles/esxi-collections/processes.md) - [Routes](/air/features/acquisition/acquisition-profiles/esxi-collections/routes.md) - [Routing Table Info](/air/features/acquisition/acquisition-profiles/esxi-collections/routing-table-info.md) - [SCSI Info](/air/features/acquisition/acquisition-profiles/esxi-collections/scsi-info.md) - [Security Policy Domain](/air/features/acquisition/acquisition-profiles/esxi-collections/security-policy-domain.md) - [Syslog Config Info](/air/features/acquisition/acquisition-profiles/esxi-collections/syslog-config-info.md) - [Syslog Logger Info](/air/features/acquisition/acquisition-profiles/esxi-collections/syslog-logger-info.md) - [System](/air/features/acquisition/acquisition-profiles/esxi-collections/system.md) - [User Info](/air/features/acquisition/acquisition-profiles/esxi-collections/user-info.md) - [VIB Info](/air/features/acquisition/acquisition-profiles/esxi-collections/vib-info.md) - [VmkNicList](/air/features/acquisition/acquisition-profiles/esxi-collections/vmkniclist.md) - [Vswitch Standard Info](/air/features/acquisition/acquisition-profiles/esxi-collections/vswitch-standard-info.md) - [WBEM Info](/air/features/acquisition/acquisition-profiles/esxi-collections/wbem-info.md) - [Disk and Volume Imaging](/air/features/acquisition/disk-and-volume-imaging.md) - [Imaging with interACT](/air/features/acquisition/disk-and-volume-imaging/imaging-with-interact.md) - [macOS Disk Imaging](/air/features/acquisition/disk-and-volume-imaging/macos-disk-imaging.md): Definitive guidance for imaging APFS disks on Intel and Apple Silicon Macs - [Scheduling Tasks](/air/features/acquisition/scheduling-tasks.md): Proactive DFIR and automated threat analysis by scheduling AIR Evidence Collections - [Task Creation](/air/features/acquisition/task-creation.md) - [Asset Management with Persistent Saved Filters](/air/features/acquisition/task-creation/asset-management-with-persistent-saved-filters.md) - [Regex in DRONE:](/air/features/acquisition/task-creation/regex-in-drone.md) - [Task Cancellation and Deletion](/air/features/acquisition/task-creation/task-cancellation-and-deletion.md) - [Auto Tagging & Tags](/air/features/auto-tagging-and-tags.md): How to automatically tag your assets based on simple conditions. - [Tags](/air/features/auto-tagging-and-tags/tags.md) - [Chain Of Custody](/air/features/chain-of-custody.md): How AIR Protects your Chain of Custody with content hashing and RFC3161 Time-stamping - [Compare](/air/features/compare.md) - [Console Audit Logs](/air/features/console-audit-logs.md) - [DRONE](/air/features/drone.md) - [What is DRONE?](/air/features/drone/what-is-drone.md): Lightning Fast, 24/7 Automated Compromise Assessment Technology - [Server-side DRONE Analysis](/air/features/drone/server-side-drone-analysis.md) - [What is an Analysis Pipeline?](/air/features/drone/what-is-an-analysis-pipeline.md): Brief overview of DRONES's Analysis Pipeline - [Analyzers](/air/features/drone/analyzers.md) - [MITRE ATT\&CK Analyzer changelog](/air/features/drone/mitre-att-and-ck-analyzer-changelog.md): This page tracks the updates/changes to AIR's MITRE ATT\&CK Analyzer - [Event Subscription](/air/features/event-subscription.md) - [Evidence Repositories](/air/features/evidence-repositories.md): Where to save your collected data - [Generating a SAS URL](/air/features/evidence-repositories/generating-a-sas-url.md) - [File Explorer](/air/features/file-explorer.md) - [File Explorer - FAQs](/air/features/file-explorer/file-explorer-faqs.md) - [Fleet AI](/air/features/fleet-ai.md) - [Full Text Search](/air/features/full-text-search.md): Search for keywords and patterns across file contents on remote assets - [Hunt/Triage](/air/features/triage.md): Threat Hunting at speed and scale - [Schedule Hunt/Triage Tasks](/air/features/triage/schedule-triage-tasks.md): This page provides a guide of how users can schedule Hunt/Triage tasks via the AIR API. - [Hunt/Triage Rule Templates](/air/features/triage/triage-rule-templates.md): Here we provide some YARA, Sigma and osquery rule templates for users to copy and edit - [Sigma Templates](/air/features/triage/triage-rule-templates/sigma-templates.md): Selection of Sigma rules for use as guides or templates - [YARA Templates](/air/features/triage/triage-rule-templates/yara-templates.md): Selection of YARA rules for use as guides or templates - [osquery Templates](/air/features/triage/triage-rule-templates/osquery-templates.md): Selection of osquery rules for use as guides or templates - [Integrations](/air/features/integrations.md): How to integrate AIR for a fully automated Incident Response - [Microsoft Azure Cloud Platform Integration](/air/features/integrations/microsoft-azure-cloud-platform-integration.md) - [SSO Integrations](/air/features/integrations/sso-integrations.md) - [FortiAuthenticator SAML 2.0 SSO Integration](/air/features/integrations/sso-integrations/fortiauthenticator-saml-2.0-sso-integration.md) - [Microsoft Azure SSO Integration](/air/features/integrations/sso-integrations/microsoft-azure-sso-integration.md) - [Okta SAML 2.0 SSO Integration](/air/features/integrations/sso-integrations/okta-saml-2.0-sso-integration.md): Setting up Okta for AIR (Available from AIR 4.1) - [Webhooks](/air/features/integrations/webhooks.md) - [Carbon Black Cloud Integration](/air/features/integrations/webhooks/carbon-black-cloud-integration.md): This script integrates Carbon Black Cloud (CBC) and AIR. It is written in Python and uses the CBAPI library to interact with the CB Defense platform. - [Cisco XDR Integration](/air/features/integrations/webhooks/cisco-xdr-integration.md) - [Cortex XSOAR Integration](/air/features/integrations/webhooks/cortex-xsoar-integration.md): Integration of AIR with Cortex XSOAR is possible via Plug-In. - [Crowdstrike Integration](/air/features/integrations/webhooks/crowdstrike-integration.md) - [Dynatrace Integration](/air/features/integrations/webhooks/dynatrace-integration.md): Using webhooks in Dynatrace, whenever Dynatrace detects a problem in the environment, a webhook triggers an HTTP POST request to a target URL that AIR Console. - [Elasticsearch Logstash Kibana Integration](/air/features/integrations/webhooks/elasticsearch-logstash-kibana-integration.md): This integration is built with the watcher feature of ELK by using sample data. In order to produce this watcher, the watcher's payload must be customized accordingly to parse Endpoint IP or Hostname. - [Fortigate SIEM Integration](/air/features/integrations/webhooks/fortigate-siem-integration.md): The Fortigate's webhook automation stitch action makes HTTP and HTTPS requests to AIR server. - [IBM QRadar Integration](/air/features/integrations/webhooks/ibm-qradar-integration.md) - [LogicHub SOAR (DEVO) Integration](/air/features/integrations/webhooks/logichub-soar-devo-integration.md) - [Mattermost Integration](/air/features/integrations/webhooks/mattermost-integration.md): Using this integration, users can trigger webhooks from chat windows with slash commands. - [Microsoft 365 Defender Integration](/air/features/integrations/webhooks/microsoft-365-defender-integration.md) - [Microsoft Sentinel Integration](/air/features/integrations/webhooks/microsoft-sentinel-integration.md): With Azure Logic Apps and the built-in HTTP trigger or action, users can create automated tasks and workflows that send outbound requests to AIR. - [Rapid7 InsightIDR Integration](/air/features/integrations/webhooks/rapid7-insightidr-integration.md): The Universal Webhook Data Exporter allows you to integrate Rapid7 Platform products with AIR to respond in a specified way when events trigger on the Rapid7 Platform. - [SentinelOne Integration](/air/features/integrations/webhooks/sentinelone-integration.md) - [ServiceNow Integration](/air/features/integrations/webhooks/servicenow-integration.md): Integration of AIR with ServiceNow is possible via the feature called "Business Rules". - [Slack Integration](/air/features/integrations/webhooks/slack-integration.md) - [Splunk Integration](/air/features/integrations/webhooks/splunk.md) - [Stellar XDR Integration](/air/features/integrations/webhooks/stellar-xdr-integration.md) - [Sumo Logic Integration](/air/features/integrations/webhooks/sumo-logic-integration.md): This integration is built with a webhook connection of Sumo Logic SIEM. - [Wazuh Integration](/air/features/integrations/webhooks/wazuh-integration.md) - [interACT](/air/features/interact.md): Purpose-Built, Multi-Asset, Cross Platform Remote Shell for DFIR - [interACT Commands](/air/features/interact/interact-commands.md) - [interACT Command Snippets](/air/features/interact/interact-command-snippets.md) - [PowerShell commands in interACT](/air/features/interact/powershell-commands-in-interact.md) - [Investigation Hub](/air/features/investigation-hub.md): Harness the power of consolidation, prioritization, and collaboration for efficient incident response investigations - [Investigation Hub – Data Usage Statistics Dashboard](/air/features/investigation-hub/investigation-hub-data-usage-statistics-dashboard.md) - [Using the Investigation Hub](/air/features/investigation-hub/using-the-investigation-hub.md) - [Off-Network Responder](/air/features/off-network-endpoint.md): How to collect evidence from, or run a triage on an off-network asset and then import the results into AIR? - [biunzip](/air/features/off-network-endpoint/biunzip.md): ‘biunzip’ is a command-line tool from Binalyze specifically designed to extract zip files generated by the AIR Off-Network responder. - [biunzip password file](/air/features/off-network-endpoint/biunzip/biunzip-password-file.md) - [Setting Up a Custom Case Directory](/air/features/off-network-endpoint/setting-up-a-custom-case-directory.md): Explains how it is possible to create a custom directory for your off-network collector - [Policies](/air/features/policies.md) - [Proxy Configuration on the Console](/air/features/proxy-configuration-on-the-console.md) - [Repository Explorer](/air/features/repository-explorer.md): Repository Explorer – Centralized Management of Evidence Repositories - [Responder Proxy Support](/air/features/responder-proxy-support.md) - [Timeline](/air/features/timeline.md) - [Tornado (Preview Version)](/air/features/tornado-preview-version.md) - [Getting Started with Tornado](/air/features/tornado-preview-version/getting-started-with-tornado.md) - [Tornado Terminology](/air/features/tornado-preview-version/getting-started-with-tornado/tornado-terminology.md) - [Tornado Collectors](/air/features/tornado-preview-version/tornado-collectors.md) - [Access Modes in O365](/air/features/tornado-preview-version/tornado-collectors/access-modes-in-o365.md) - [O365 license types](/air/features/tornado-preview-version/tornado-collectors/access-modes-in-o365/o365-license-types.md) - [O365 Collector Prerequisites](/air/features/tornado-preview-version/tornado-collectors/access-modes-in-o365/o365-collector-prerequisites.md) - [Accessing Google Workspace](/air/features/tornado-preview-version/tornado-collectors/accessing-google-workspace.md) - [Service Account Creation](/air/features/tornado-preview-version/tornado-collectors/accessing-google-workspace/service-account-creation.md) - [Enable Service Account Key Creation](/air/features/tornado-preview-version/tornado-collectors/accessing-google-workspace/service-account-creation/enable-service-account-key-creation.md) - [DRONE Integration in Tornado](/air/features/tornado-preview-version/tornado-drone-integration.md) - [Tornado Demo](/air/features/tornado-preview-version/tornado-demo-video.md) - [Tornado FAQs](/air/features/tornado-preview-version/tornado-faqs.md) - [Tornado Installation Guide](/air/features/tornado-preview-version/tornado-installation-guide.md) - [Tornado Operating System Support](/air/features/tornado-preview-version/tornado-installation-guide/tornado-operating-system-support.md): Tornado is supported for use on the following OS platforms - [Tornado Troubleshooting & Feedback](/air/features/tornado-preview-version/tornado-troubleshooting-and-feedback.md) - [Updating Tornado](/air/features/tornado-preview-version/updating-tornado.md) - [Integrations](/air/integrations.md): How to integrate AIR for a fully automated Incident Response - [Microsoft Azure Cloud Platform Integration](/air/integrations/microsoft-azure-cloud-platform-integration.md) - [SSO Integrations](/air/integrations/sso-integrations.md) - [Microsoft Azure SSO Integration](/air/integrations/sso-integrations/microsoft-azure-sso-integration.md) - [Okta SAML 2.0 SSO Integration](/air/integrations/sso-integrations/okta-saml-2.0-sso-integration.md): Setting up Okta for AIR (Available from AIR 4.1) - [FortiAuthenticator SAML 2.0 SSO Integration](/air/integrations/sso-integrations/fortiauthenticator-saml-2.0-sso-integration.md) - [Webhooks](/air/integrations/webhooks.md) - [Mattermost Integration](/air/integrations/webhooks/mattermost-integration.md): Using this integration, users can trigger webhooks from chat windows with slash commands. - [Splunk Integration](/air/integrations/webhooks/splunk.md) - [IBM QRadar Integration](/air/integrations/webhooks/ibm-qradar-integration.md) - [Wazuh Integration](/air/integrations/webhooks/wazuh-integration.md) - [Cortex XSOAR Integration](/air/integrations/webhooks/cortex-xsoar-integration.md): Integration of AIR with Cortex XSOAR is possible via Plug-In. - [Elasticsearch Logstash Kibana Integration](/air/integrations/webhooks/elasticsearch-logstash-kibana-integration.md): This integration is built with the watcher feature of ELK by using sample data. In order to produce this watcher, the watcher's payload must be customized accordingly to parse Endpoint IP or Hostname. - [ServiceNow Integration](/air/integrations/webhooks/servicenow-integration.md): Integration of AIR with ServiceNow is possible via the feature called "Business Rules". - [Sumo Logic Integration](/air/integrations/webhooks/sumo-logic-integration.md): This integration is built with a webhook connection of Sumo Logic SIEM. - [Crowdstrike Integration](/air/integrations/webhooks/crowdstrike-integration.md) - [Microsoft Sentinel Integration](/air/integrations/webhooks/microsoft-sentinel-integration.md): With Azure Logic Apps and the built-in HTTP trigger or action, users can create automated tasks and workflows that send outbound requests to AIR. - [Slack Integration](/air/integrations/webhooks/slack-integration.md) - [Carbon Black Cloud Integration](/air/integrations/webhooks/carbon-black-cloud-integration.md): This script integrates Carbon Black Cloud (CBC) and AIR. It is written in Python and uses the CBAPI library to interact with the CB Defense platform. - [Rapid7 InsightIDR Integration](/air/integrations/webhooks/rapid7-insightidr-integration.md): The Universal Webhook Data Exporter allows you to integrate Rapid7 Platform products with AIR to respond in a specified way when events trigger on the Rapid7 Platform. - [LogicHub SOAR (DEVO) Integration](/air/integrations/webhooks/logichub-soar-devo-integration.md) - [Fortigate SIEM Integration](/air/integrations/webhooks/fortigate-siem-integration.md): The Fortigate's webhook automation stitch action makes HTTP and HTTPS requests to AIR server. - [Dynatrace Integration](/air/integrations/webhooks/dynatrace-integration.md): Using webhooks in Dynatrace, whenever Dynatrace detects a problem in the environment, a webhook triggers an HTTP POST request to a target URL that AIR Console. - [Stellar XDR Integration](/air/integrations/webhooks/stellar-xdr-integration.md) - [SentinelOne Integration](/air/integrations/webhooks/sentinelone-integration.md) - [Microsoft 365 Defender Integration](/air/integrations/webhooks/microsoft-365-defender-integration.md) - [Cisco XDR Integration](/air/integrations/webhooks/cisco-xdr-integration.md) - [Troubleshooting](/air/troubleshooting.md) - [Understanding MSI Error Code 1618](/air/troubleshooting/understanding-msi-error-code-1618.md): This article explains the reasons behind MSI Error Code 1618 and provides practical steps to resolve it. - [Collecting Responder Log Files](/air/troubleshooting/collecting-responder-log-files.md) - [Collecting Off-Network Responder Log Files](/air/troubleshooting/collecting-off-network-responder-log-files.md) - [FAQs](/air/faqs.md) - [How to download the collected evidence and artifacts?](/air/faqs/how-to-download-the-collected-evidence-and-artifacts.md) - [Collecting Responder Log Files](/air/faqs/collecting-responder-log-files.md) - [Managing database usage](/air/faqs/managing-database-usage.md) - [Collecting Off-Network Responder Log Files](/air/faqs/collecting-off-network-responder-log-files.md) - [Responder troubleshooting](/air/faqs/responder-troubleshooting.md): This article explains how to troubleshoot AIR responder problems. - [Understanding Port Usage](/air/faqs/what-ports-are-used.md): What ports are used by the platform? - [How many assets can connect to a single Console instance?](/air/faqs/how-many-endpoints-can-connect-to-a-single-console-instance.md): Connecting assets to a single Console Instance - [Can I use AIR with EDR/XDR Products?](/air/faqs/edr-xdr-integration.md): Using AIR with EDR/XDR Products - [Can I integrate AIR with my SOAR/SIEM?](/air/faqs/siem-soar-integration.md): Integrating AIR with SOAR/SIEM - [What external URLs are used?](/air/faqs/what-are-the-external-urls-used.md): AIR (sub)domains - [Monitoring Responder and UI API's](/air/faqs/monitoring-responder-and-ui-apis.md) - [How do I update Responders on assets?](/air/faqs/how-do-i-update-endpoints.md): Updating AIR Responders - [How to reset the password of a user via the CLI?](/air/faqs/how-to-reset-the-password-of-a-user-via-the-cli.md) - [Is there a way to move an asset from one Organization or Case to another?](/air/faqs/is-there-a-way-to-move-an-asset-from-one-organization-or-case-to-another.md) - [Anything missing?](/air/faqs/roadmap.md): Help us shape the future of our next-gen automated investigation and response platform.