AIR CLI is a command-line utility that enables system administrators to manage and troubleshoot the Binalyze AIR Console. It provides several operations such as restoring backups, managing users, adjusting security settings, and toggling system features. The tool is executed inside the container where the AIR application is running.
How to Access AIR CLI
To open the AIR CLI, execute the following command on the AIR Console host machine:
sudo docker exec -ti binalyze-air-app-1 /air-cli
This will launch an interactive command-line interface (CLI) where you can select from available operations using a menu.
1. Restore Using a Backup File
This operation allows you to restore the entire AIR Console system from a backup file. It can be useful in disaster recovery scenarios or when migrating between environments.
Important: Restoring a backup will delete all current data and replace it with the data from the backup. Be sure to take a fresh backup if needed before proceeding.
Before using this option, you must copy the backup file into the container using the following command (replace {{BACKUP_FILE_PATH}} with the actual file path):
Once the file is copied, you can select this option in the CLI and follow the prompts.
Example input/output:
1 ? I would like to... restore using a backup file
2 ? Please enter the path of file (Just press "Enter" to use the default) /air-backup.abf
3 ? Please provide the MongoDB URI (Just press "Enter" to use the default) mongodb://air.mongodb.server/airdb
4 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
5 ? Please provide the backed up MongoDB name (Just press "Enter" to use the default) airdb
6 ? Please provide the MongoDB name to restore (Just press "Enter" to use the default) airdb
7 ? This operation will drop your current database and restore the provided backup. Are you sure to continue?
Yes
8
9 (...)
10
11 Restore operation started.
12 .env file restored.
13 Data directory (data.zip) restore started.
14 Data directory restored. Path: /binalyze-air
15
16 postgresql.dump extraction started.
17 postgresql.dump extraction completed.
18 PostgreSQL restore started.
19
20 (...)
21
22 2025-04-17T18:42:59.626+0000 3375 document(s) restored successfully. 0 document(s) failed to restore.
23 MongoDB restore completed.
24 Restore operation completed!
2. Reset Local User Password
This option allows you to reset the password of a local user account. The new password is temporary, and the user will be required to change it upon their next login. This is especially helpful if a user forgets their password.
Example input/output:
1 ? I would like to... reset password for a user
2 ? Please provide a username binalyze
3 ? Please provide a password *********
4 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
5 Password for user 'binalyze' updated.
6 Password reset operation completed!
3. Reset Local User TFA
This option resets two-factor authentication (TFA) for a specified user. It is useful if the user loses access to their authenticator device and cannot log in.
1 ? I would like to... reset TFA for a user
2 ? Please provide a username binalyze
3 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
4 TFA reset operation completed!
If the 'Enforce 2FA authentication for all users' option under Settings > Security is enabled, users will be required to reconfigure 2FA following the reset.
4. Enable/Disable IP Restriction Settings
You can use this option to enable or disable IP restriction for accessing the console. When enabled, only allowed IP addresses can connect to the AIR Console interface.
Example input/output:
1 ? I would like to... set ip restriction settings
2 ? What would you like to do? Disable
3 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
4 IP restriction settings is disabled.
5 Set IP Restriction Successfully completed!
5. Reset Statistics Start Date
This option allows you to reset the start date used for the Activity Dashboard. The date will be set to the time you run this command.
Example input/output:
1 ? I would like to... reset statistics start date
2 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
3 Statistics Start Date is 2025-04-17T18:48:54.688Z.
4 Statistics Start Date Reset Successfully completed!
6. Enable/Disable Console Port Settings
This option allows you to enable or disable the UI access port 8443 settings.
Example input/output
1 ? I would like to... set console port settings
2 ? What would you like to do? Disable
3 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://airdata:#
DBPASSWORD#@air.data-master.server:5432/airdb
4 Console port settings is disabled.
5 Please restart the app for the settings to take effect.
6 Set Console Port Successfully completed!
7. Turn On/Off Features
This option allows you to toggle features. You will be presented with a list of available features and can enable/disable them individually.
Available feature flags include:
investigation-hub-data-access
investigation-findings-object-columns
cloud-forensics
investigation-event-records-details-columns
purge-without-uninstall
skip-2fa-for-api-users
user-management-via-api
userflow
auth-management-via-api
isolation-allowed-list
cloud-forensics-trial
relay-server
investigation-hub-generate-report
linux-isolation
sample-feature
disk-image-asset-type
frank-ai
consolidated-report
locard
integra-ui
activity-overview
sentry-monitoring
backward-compatibility
investigation-hub-import-evidence
Example input/output:
1 ? I would like to... turn on/off features for offline installations
2 ? Select a feature to turn on/off (Use arrow keys)
3 ❯ (...)
4 ? Select a feature to turn on/off sample-feature
5 ? What would you like to do? Disable
6 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
7 Feature flags updated.
8 Turn on/off feature flag completed!
This setting is applicable only to offline systems. If your AIR Console server has internet access, feature flags are updated during each license check, and this setting will be overridden.
8. Update MITRE Rules
This operation updates the MITRE ATT&CK rules used by the AIR Console manually.
Then, copy it into the container using the command below (replace {{MITRE_FILE_PATH}} with your actual file path):
After that, run the CLI and follow the prompts to complete the update.
Example input/output:
1 ? I would like to... update mitre rules
2 ? Please enter the path of file (Just press "Enter" to use the default) /mitre.zip
3 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
4
5 Current Mitre version: 9.1.3
6 New Mitre version: 9.1.4
7 Restart AIR app container to apply the new ruleset.
8 Update Mitre rules completed!
9. Change Users' Organization
This command allows you to move one or more users to a different organization by providing their email addresses and the new organization ID.
Example input/output:
1 ? I would like to... change users organization
2 ? Please provide a email(s), for multiple please use comma seperated emails [email protected]3 ? Please provide a organizationId 0
4 ? Please provide the PostgreSQL URI (Just press "Enter" to use the default) postgresql://air-
data:#DBPASSWORD#@air.data-master.server:5432/airdb
5 #1 Users will be updated
6 List: [email protected]7 Update in progress....
8 #1 Users were updated:
9 Update progress done!
10 Change user organizations operation completed!
Restore Using a Backup File
You can access the article with details about this operation here:
🔄 You must first download the MITRE rules file from:
