Skip to content
Binalyze Knowledge Base

Network Communication

How Do Assets Communicate with the Console?

Section titled “How Do Assets Communicate with the Console?”

All routine communication between assets and the AIR console is initiated by the assets—they do not receive incoming requests from external sources. Communication occurs through various protocols and channels:

Primary Communication Channels

Section titled “Primary Communication Channels”
  • HTTPS (TCP 443) – The main communication channel from assets to the console (e.g., yourcompany.binalyze.io).
  • WebSocket over HTTPS (TCP 443) – Used for interACT features.
  • NATS (TCP 4222) (Optional) – Supports real-time task pushes to assets. If this port is unavailable, AIR defaults to HTTP(S) polling for task retrieval.
  • DNS (UDP/TCP 53) – Required for name resolution services.

Task Result Uploads (SaaS)

Section titled “Task Result Uploads (SaaS)”

In SaaS deployments, responders upload task results (case.ppc and Drone.zip) through the AIR upload CDN instead of sending them to the console:

  • HTTPS (TCP 443) to *.binalyze.io – The console authorizes each upload, and the responder sends the file to the AIR upload CDN. Allow *.binalyze.io over TCP 443 so that assets can reach it.
  • The upload CDN hostname depends on your region (e.g. upload.eu.binalyze.io).

  • Tenants with a customer-managed encryption key (CMEK) use a dedicated upload hostname instead of the regional one. This hostname is also under *.binalyze.io, so the same rule covers it. Allow it by hostname rather than IP address, because the CDN addresses can change. If no upload hostname is configured for the tenant, responders upload task results through the console.

  • The integrity of each uploaded file is verified on arrival.

  • If the upload CDN cannot be reached, the responder falls back to uploading the task result through the console.

External Communication

Section titled “External Communication”
  • HTTPS to responder.cdn.binalyze.com – Used for responder updates and installation packages. If the CDN is unavailable, the AIR console acts as a fallback source.

Evidence Repository Communication (When Configured)

Section titled “Evidence Repository Communication (When Configured)”
  • Cloud Storage: HTTPS communication to services like Amazon S3 and Azure.
  • Traditional Storage: Supported via SFTP, FTPS, or SMB.

Proxy Support

Section titled “Proxy Support”

If a proxy is configured in your environment, assets can communicate using:

  • HTTP
  • HTTPS
  • SOCKS5

Firewall Rules

Section titled “Firewall Rules”
  • The console installer automatically adds inbound allow rules for the required ports in the Windows Firewall.
  • The responder installer does not modify firewall settings. You must ensure that enterprise firewall policies allow assets to communicate with the console over the required ports.

How Does the AIR UI Connect?

Section titled “How Does the AIR UI Connect?”

The AIR user interface (UI) requires access to the following domains:

Domain Functions:

Section titled “Domain Functions:”
Domain Categories Description
https://binalyze.comUPDATEThis domain is used by AIR Server instances to check if there is any new version to update.
https://license.binalyze.comLICENSEThis domain is used by AIR Server instances to check the licence information
https://api.binalyze.comTIMESTAMPThis domain is used by AIR Server for RFC 3161 features which requires integration with a timestamp server.
https://cdn.binalyze.comUPDATEThis domain is used by AIR Server instances to update artefacts like MITRE Attack Rules , docker compose files, update scripts, offline installer packages.
https://one.binalyze.com

FIS USAGE STATS

FEATURE FLAGS

USAGE ANALYTICS

This domain is used by AIR Server instances to

  • Collect case activity & Organization ID metrics for FIS License charges/billing.
  • Feature flag service to enable/disable features on AIR.
  • Analytics to analyse usage statistics.
https://cr.binalyze.comUPDATEThis domain is a container registry for AIR Server instances to update server components like the application server images, database images, caching server images, etc.

Data Transmitted:

Section titled “Data Transmitted:”
Domain Data Sent To Domain Data Received From Domain
https://binalyze.comN/AVersion Information
https://license.binalyze.comLicense KeyLicense Status Details
https://api.binalyze.com

Hash of PPC

Ref: [AIR] Timestamp PPC Files RFC-3161

RFC-3161 Timestamp Token
https://cdn.binalyze.comN/AInstallation Packages
https://one.binalyze.com

FIS USAGE STATS:

OrganizationID’s, Case Id, License Key, CaseEventType, CaseEventTime,
endpoint Id, Task Id

i.e.: "logId": 764149386100000, "type": "endpointTaskAddedToCaseEvent", "publishedDate": "2022-06-03T10:22:18.610Z", "data": { "caseId": "C-2022-0028", "endpointId": "2b2ea7b0-be61-445c-b735-ac1a9a39e448", "taskAssignmentId": "2b1d5b2c-72ac-4828-9a82-b3510ce9fd5a" }, "license": "LICENSE-KEY"

FEATURE FLAGS: License Key

USAGE ANALYTICS: Amplitude event structure

FEATURE FLAGS: Feature flag states

USAGE ANALYTICS: N/A

https://cr.binalyze.comN/ABinary Packages