What is DRONE?

DRONE is AIR’s automated compromise assessment feature, providing a powerful decision support system to accelerate security investigations. It automatically analyzes collected evidence and live assets using a library of always-up-to-date analyzers maintained by the Binalyze threat hunting team.

DRONE can be executed in multiple operation contexts:

• Responder-side (Assets): Analysis takes place via the Responder on the asset as part of an evidence collection or threat hunt.
• Server-side (Console): Previously collected evidence is analyzed or reanalyzed directly on the AIR database server, without any requirement to reconnect to the original asset. Learn more in Server-side DRONE Analysis.

• Tornado-integrated (Cloud Evidence): In Tornado workflows, DRONE analyzes collected cloud evidence locally in the Tornado application and packages findings into the case output for downstream investigation workflows. Learn more in DRONE Integration in Tornado.

On Acquisition and Hunt/Triage you select a DRONE Analyzer Profile. Acquisition runs the analyzers, rules, and configuration saved in that profile. Hunt/Triage runs only the rules selected under the profile’s MITRE ATT&CK Scanner. Re-Analyze in the Investigation Hub is separate: it has no profile and no configuration, and every Case analyzer runs in full on the case tables.

By automatically classifying findings as High, Medium, Low, or Matched, DRONE pinpoints anomalies and potential indicators of compromise, dramatically reducing investigation time and effort.

Read more about DRONE, AIR’s built-in automated compromise assessment technology here: Automated Compromise Assessment with DRONE