Links

What is AIR?

Automated Incident Response platform
AIR is an "Automated Incident Response" platform that provides the most complete feature set for:
  • Remotely collecting 150+ evidence types in minutes,
  • Capturing the "Forensic State" of an endpoint as a well organized HTML/JSON report,
  • Performing triage on thousands of endpoints using YARA,
  • Integrating with SIEM/SOAR/EDR products for automating the response phase IR,
  • Enriching alerts for eliminating false positives,
  • Investigating pre-cursors generated by other security products.