Collect Evidence
Overview
Section titled “Overview”Collect Evidence actions start AIR tasks on the execution’s target asset. Use them to collect evidence, hunt for threats, or classify assets automatically, without anyone assigning the task manually.
| Action | Description |
|---|---|
| Start Hunt/Triage | Runs selected Hunt/Triage rules (YARA, Sigma, osquery) on the asset. |
| Start Evidence Acquisition | Collects evidence from the asset using an acquisition profile. |
| Start Baseline Acquisition | Takes a baseline acquisition of the asset. |
| Start Auto Asset Tagging | Applies Auto Asset Tagging rules to the asset. |
Common behavior
Section titled “Common behavior”All Collect Evidence actions share the following behavior:
- They always run on the target asset of the execution, that is, the asset from the trigger. You do not select an asset in the action.
- They start a task and wait for it to finish; meanwhile, the step shows Deferred. The next action only starts after the task completes successfully. If the task fails, is canceled, or expires, the step and the execution fail.
- The step links to the created task, so you can follow it on the task screens.
- They cannot be tested from the editor.
- Where a Case can be selected, the list contains the cases of the automation’s organization. If the Case Selection setting enforces mandatory case selection, you must select a case before you can publish the automation.