Schedule Triage Tasks

This page provides a guide of how users can schedule Triage tasks via the AIR API.

AIR Triage Scheduled Task via API Script by using crontab

• Download the script and grant permission to run.

  wget https://cdn.binalyze.com/air-deploy/scripts/air-triage-task-via-api.sh chmod +x air-triage-task-via-api.sh

• Move the script file to a directory, such as the /opt directory, as shown below.

  mv air-triage-task-via-api.sh /opt/air-triage-task-via-api.sh

• Update the console address and API Token value in the script. You must add the desired triage rule id values to the "triageRuleIds" field.

For example, there are two default rules below; you can change them.

"fireeye-red-team-tools-countermeasures", "fireeye-sunburst-countermeasures"

• Add it as a cronjob by running the command below.

  crontab -e

• After running the above command, add the following lines in the editor.

# At 00:00 on Sunday 0 0 * * 0 /opt/air-triage-task.sh