DRONE Analyzer Profiles

A DRONE Analyzer Profile is a reusable set of DRONE analyzers, detection rules, and analysis settings. You save it in Libraries, then select it when you start a task. DRONE runs with that selection.

Acquisition and Hunt/Triage both offer the profile on the task setup step. They apply it differently:

Acquisition runs the analyzers, rules, and configuration saved in the profile for the asset’s operating system.
Hunt/Triage runs only the rules selected under the profile’s MITRE ATT&CK Scanner. Rules selected under other analyzers are not part of the Hunt/Triage task. YARA, Sigma, and osquery rules from the Hunt/Triage library still run as their own selection.

The task keeps the profile as it was when the task was created. Later edits in Libraries apply to new tasks.

Where profiles live

Open Libraries > DRONE Analyzer Profiles.

Device profiles cover Windows, Linux, and macOS. Each operating system has its own analyzer and rule selection. Acquire Evidence and Hunt/Triage select from this list.
Disk Image profiles hold analyzer and rule selections for disk-image analysis. Hunt/Triage does not offer Disk Image profiles.

AIR includes a built-in Full profile for each list. Full contains the analyzers and rules available for that profile type and stays aligned with DRONE analyzer updates. Full is read-only.

Custom profiles use the same privileges as Acquisition Profiles: view, create, update, and delete. You can limit a custom profile to selected organizations. Leave the organization list empty to make the profile available in every organization.

Creating a profile

Go to Libraries > DRONE Analyzer Profiles.
Open Device or Disk Image.
Select Add New Profile and name the profile.
Select analyzers and the rules under each analyzer. List view works by operating system. MITRE ATT&CK view works by tactic.
Set the analysis configuration. This includes minimum severity, exclusions, keywords, match limits, YARA file and process-memory scanning, and the platform limits for Windows events, Linux logs, and macOS events.
Save the profile.

A profile needs at least one analyzer, one rule, or one keyword.

Using a profile on Acquisition

On the Acquire Evidence setup step, turn on Run DRONE Analysis and select a DRONE Analyzer Profile. The Acquisition Profile decides which evidence is collected. The DRONE Analyzer Profile decides which analyzers and settings DRONE uses on that evidence.

DRONE applies the operating-system selection that matches the asset. A Windows asset uses the Windows selection, a Linux asset uses the Linux selection, and a macOS asset uses the macOS selection. IBM AIX assets do not run DRONE from an analyzer profile.

Turn Run DRONE Analysis off to collect evidence without DRONE.

The profile requires AIR Responder 3.5.0 or later. An older Responder runs the default DRONE analysis. An Off-Network package must include Responder 3.5.0 or later. An older package does not apply the profile.

Using a profile on Hunt/Triage

On the Hunt/Triage setup step, turn on Run DRONE Analysis and select a Device DRONE Analyzer Profile.

The task uses the rules selected under MITRE ATT&CK Scanner in that profile. Rules selected under every other analyzer stay in the library profile and are left out of this task. Keyword lists saved on the profile are also left out. Other profile settings, such as minimum severity, still apply to the MITRE ATT&CK Scanner run.

If the selected profile has no MITRE ATT&CK Scanner rules, the setup page warns that DRONE analysis will produce no findings.

You can combine the profile with rules from Libraries > Hunt/Triage Rules. Those YARA, Sigma, and osquery rules are independent of the profile. A Hunt/Triage task needs at least one of those rules, or a DRONE Analyzer Profile with Run DRONE Analysis turned on.

The profile requires AIR Responder 3.5.0 or later. An older Responder runs the default MITRE ATT&CK analysis. An Off-Network Hunt/Triage package must include Responder 3.5.0 or later.

Re-Analyze in the Investigation Hub

Re-Analyze on the Investigation Hub Dashboard runs DRONE on the evidence already loaded into the case. The action stays on the Console and uses the tables in the Investigation Hub.

This run has no DRONE Analyzer Profile and no configuration. Every Case analyzer runs in full against that table data. Analyzer, rule, and setting choices from a library profile are not part of Re-Analyze.

Live checks that need the asset, including the MITRE ATT&CK Scanner, stay on Acquisition and Hunt/Triage. See Server-side DRONE Analysis.