Using CLI on Console
Overview
AIR CLI is a command-line utility that enables system administrators to manage and troubleshoot the AIR Console. It provides several operations such as restoring backups, managing users, adjusting security settings, and toggling system features. The tool is executed inside the container where the AIR application runs.
How to Access AIR CLI
To open the AIR CLI, execute the following command on the AIR Console host machine:
This will launch an interactive command-line interface (CLI) where you can select from available operations using a menu.
1. Restore Using a Backup File
This operation allows you to restore the entire AIR Console system from a backup file. It can be useful in disaster recovery scenarios or when migrating between environments.
Important: Restoring a backup will delete all current data and replace it with the data from the backup. Be sure to take a fresh backup if needed before proceeding.
Before using this option, you must copy the backup file into the container using the following command (replace {{BACKUP_FILE_PATH}} with the actual file path):
Once the file is copied, you can select this option in the CLI and follow the prompts.
Example input/output:
You can access the article with details about this operation here: Restore AIR Backup using the CLI | Knowledge Base
2. Reset Local User Password
This option allows you to reset the password of a local user account. The new password is temporary, and the user will be required to change it upon their next login. This is especially helpful if a user forgets their password.
Example input/output:
3. Reset Local User TFA
This option resets two-factor authentication (TFA) for a specified user. It is useful if the user loses access to their authenticator device and cannot log in.
If the 'Enforce 2FA authentication for all users' option under Settings > Security is enabled, users will be required to reconfigure 2FA following the reset.
4. Enable/Disable IP Restriction Settings
You can use this option to enable or disable IP restriction for accessing the console. When enabled, only allowed IP addresses can connect to the AIR Console interface.
Example input/output:
5. Reset Statistics Start Date
This option allows you to reset the start date used for the Activity Dashboard. The date will be set to the time you run this command.
Example input/output:
6. Enable/Disable Console Port Settings
This option allows you to enable or disable the UI access port 8443 settings.
Example input/output
7. Turn On/Off Features
This option allows you to toggle features. You will be presented with a list of available features and can enable/disable them individually.
Available feature flags include:
investigation-hub-data-access
investigation-findings-object-columns
cloud-forensics
investigation-event-records-details-columns
purge-without-uninstall
skip-2fa-for-api-users
user-management-via-api
userflow
auth-management-via-api
isolation-allowed-list
cloud-forensics-trial
relay-server
investigation-hub-generate-report
linux-isolation
sample-feature
disk-image-asset-type
frank-ai
consolidated-report
locard
integra-ui
activity-overview
sentry-monitoring
backward-compatibility
investigation-hub-import-evidence
Example input/output:
This setting is applicable only to offline systems. If your AIR Console server has internet access, feature flags are updated during each license check, and this setting will be overridden.
8. Update MITRE Rules
This operation updates the MITRE ATT&CK rules used by the AIR Console manually.
🔄 You must first download the MITRE rules file from: https://cdn.binalyze.com/dfir-mitre-attack-rules/mitre.zip
Then, copy it into the container using the command below (replace {{MITRE_FILE_PATH}} with your actual file path):
After that, run the CLI and follow the prompts to complete the update.
Example input/output:
9. Change Users' Organization
This command enables you to transfer one or more users to a different organization by specifying their email addresses and the new organization ID.
Example input/output:
Last updated
Was this helpful?