Network Communication
How do assets communicate with the console?
How Do Assets Communicate with the Console?
All routine communication between assets and the AIR console is initiated by the assets—they do not receive incoming requests from external sources. Communication occurs through various protocols and channels:
Primary Communication Channels
HTTPS (TCP 443) – The main communication channel from assets to the console (e.g.,
yourcompany.binalyze.io).WebSocket over HTTPS (TCP 443) – Used for interACT features.
NATS (TCP 4222) (Optional) – Supports real-time task pushes to assets. If this port is unavailable, AIR defaults to HTTP(S) polling for task retrieval.
DNS (UDP/TCP 53) – Required for name resolution services.
External Communication
HTTPS to
responder.cdn.binalyze.com– Used for responder updates and installation packages. If the CDN is unavailable, the AIR console acts as a fallback source.
Evidence Repository Communication (When Configured)
Cloud Storage: HTTPS communication to services like Amazon S3 and Azure.
Traditional Storage: Supported via SFTP, FTPS, or SMB.
Proxy Support
If a proxy is configured in your environment, assets can communicate using:
HTTP
HTTPS
SOCKS5
Firewall Rules
The console installer automatically adds inbound allow rules for the required ports in the Windows Firewall.
The responder installer does not modify firewall settings. You must ensure that enterprise firewall policies allow assets to communicate with the console over the required ports.
How Does the AIR UI Connect?
The AIR user interface (UI) requires access to the following domains:
Domain Functions:
Domain
Categories
Description
UPDATE
This domain is used by AIR Server instances to check if there is any new version to update.
LICENSE
This domain is used by AIR Server instances to check the licence information
TIMESTAMP
This domain is used by AIR Server for RFC 3161 features which requires integration with a timestamp server.
UPDATE
This domain is used by AIR Server instances to update artefacts like MITRE Attack Rules , docker compose files, update scripts, offline installer packages.
FIS USAGE STATS
FEATURE FLAGS
USAGE ANALYTICS
This domain is used by AIR Server instances to
Collect case activity & Organization ID metrics for FIS License charges/billing.
Feature flag service to enable/disable features on AIR.
Analytics to analyse usage statistics.
UPDATE
This domain is a container registry for AIR Server instances to update server components like the application server images, database images, caching server images, etc.
Data Transmitted:
Domain
Data Sent To Domain
Data Received From Domain
N/A
Version Information
License Key
License Status Details
RFC-3161 Timestamp Token
N/A
Installation Packages
FIS USAGE STATS:
OrganizationID’s, Case Id, License Key, CaseEventType, CaseEventTime, endpoint Id, Task Id
i.e.: "logId": 764149386100000, "type": "endpointTaskAddedToCaseEvent", "publishedDate": "2022-06-03T10:22:18.610Z", "data": { "caseId": "C-2022-0028", "endpointId": "2b2ea7b0-be61-445c-b735-ac1a9a39e448", "taskAssignmentId": "2b1d5b2c-72ac-4828-9a82-b3510ce9fd5a" }, "license": "LICENSE-KEY"
FEATURE FLAGS: License Key
FEATURE FLAGS: Feature flag states
USAGE ANALYTICS: N/A
N/A
Binary Packages
Last updated
Was this helpful?