Skip to content

AIR Knowledge Base

AIR
- Home
  - Overview
  - What is AIR?
  - Terminology
  - Architecture
    
    Overview
    AIR Responder Architecture; overview and performance analysis
    AIR Task Flow and Management
  - Network Communication
  - Cloud Forensics
    
    Overview
    GCP Deployment: Technical Details
- Setup
  - Overview
  - Relay Server
    
    Overview
    RelayPro
    
    Proxy configurations (Legacy)
    
    Overview
    Adding proxy to Relay Server
    
    Legacy Relay Server (Deprecated)
  - Responder
    
    Overview
    Responder Hardware Requirements
    Responder - Supported Operating Systems
    Responder for Golden Images
    Responder and Active Directory OUs
    
    Responder Exception Rules for EPP and EDR
    
    Overview
    AIR Watchdog Folder
    
    FDA via Jamf and Apple's PPPC utility
    Responder Tamper Detection
    Responder in Windows Safe Mode
    
    Proxy Configurations
    
    Overview
    Adding proxy to Responder
    Additional Proxy Details
  - Security
    
    Overview
    Two-factor authentication (2FA)
- Settings
  - Overview
  - Console Settings
    
    Overview
    General
    Assets
    Security
    Features
    Evidence Repositories
    Policies
    User Management
    Backup
    Investigation Hub Disk Usage
    Danger Zone
  - Organization Settings
  - Account Settings
  - Submitting Feedback
- Updating
  - Overview
  - Console Updating - SaaS
- Features
  - Overview
  - API
    
    Overview
    API is likely to be more effective than Webhooks
  - Asset Isolation
    
    Overview
    Maintenance Mode
  - Acquisition
    
    Overview
    Acquisition Profiles
    
    Disk and Volume Imaging
    
    Overview
    Imaging with interACT
    macOS Disk Imaging
    
    Scheduling Tasks
    
    Task Creation
    
    Overview
    Asset Management with Persistent Saved Filters
    Regex in DRONE:
    Task Cancellation and Deletion
  - Auto Tagging & Tags
    
    Overview
    Tags
  - Chain Of Custody
  - Compare
  - Console Audit Logs
  - DRONE
    
    Overview
    What is DRONE?
    Server-side DRONE Analysis
    What is an Analysis Pipeline?
    Analyzers
    MITRE ATT\&CK Analyzer changelog
  - Event Subscription
  - Evidence Repositories
    
    Overview
    Generating a SAS URL
  - File Explorer
    
    Overview
    File Explorer - FAQs
  - Fleet AI
  - Full Text Search
  - Hunt/Triage
    
    Overview
    Schedule Hunt/Triage Tasks
    
    Hunt/Triage Rule Templates
    
    Overview
    Sigma Templates
    YARA Templates
    osquery Templates
  - Integrations
    
    Overview
    Microsoft Azure Cloud Platform Integration
    SSO Integrations
    
    Webhooks
    
    Overview
    Carbon Black Cloud Integration
    Cisco XDR Integration
    Cortex XSOAR Integration
    Crowdstrike Integration
    Dynatrace Integration
    Elasticsearch Logstash Kibana Integration
    Fortigate SIEM Integration
    IBM QRadar Integration
    LogicHub SOAR (DEVO) Integration
    Mattermost Integration
    Microsoft 365 Defender Integration
    Microsoft Sentinel Integration
    Rapid7 InsightIDR Integration
    SentinelOne Integration
    ServiceNow Integration
    Slack Integration
    Splunk Integration
    Stellar XDR Integration
    Sumo Logic Integration
    Wazuh Integration
  - interACT
    
    Overview
    interACT Commands
    interACT Command Snippets
    PowerShell commands in interACT
  - Investigation Hub
    
    Overview
    Investigation Hub – Data Usage Statistics Dashboard
    Using the Investigation Hub
  - Off-Network Responder
    
    Overview
    
    biunzip
    
    Overview
    biunzip password file
    
    Setting Up a Custom Case Directory
  - Policies
  - Proxy Configuration on the Console
  - Repository Explorer
  - Responder Proxy Support
  - Timeline
  - Tornado (Preview Version)
- Integrations
- Troubleshooting
- FAQs
Self-Hosted
- Setup
  - Overview
  - Console Hardware Requirements
  - Pre-Installation Requirements
  - Installation Guide
    
    Overview
    Post-Deployment Configuration Guide
    Using CLI on Console
  - Security
    
    Overview
    Console Access Control
    Trust Center: Your Security and Compliance Hub
    
    SSL Enforcement
    
    Overview
    SSL Certificate Management
  - Uninstalling Responders
- Updating
- Backup
  - Overview
  - Restore Backup Using the CLI
- FAQs
General
- Open Source Licenses

AIR Knowledge Base

On this page

Overview
Welcome to AIR’s Documentation

On this page

Overview
Welcome to AIR’s Documentation

Home

Welcome to AIR’s Documentation

Section titled “Welcome to AIR’s Documentation”

This Knowledge Base will guide you through all the features of AIR.

What is AIR? Terminology architecture Network Communication Cloud Forensics

Last updated: Mar 7, 2026

What is AIR?