AIR Responder Processes and Services by Task Type

Overview

This page documents which processes and executables the AIR Responder runs on target endpoints during different task types. It is intended for teams who want to configure monitoring and alerting in their infrastructure monitoring tools — such as SIEM, EDR, or system monitoring platforms — to track AIR task execution patterns.

Use this reference to understand:

• Which processes run on target systems when a AIR task is initiated
• The operating system-level services and processes triggered by task execution
• The operational patterns these processes create while a task runs

General Architecture

When a AIR task — Acquisition, Hunt/Triage, Full Text Search, Disk Image, or interACT — is initiated, the task is executed by the pre-installed AIR Responder service on the target endpoint.

Note

No new or persistent services are added to the operating system during task execution. All operations are performed by temporary child processes spawned by the existing Responder service, and these processes terminate automatically when the task completes.

Main Services and Executables

The Responder installs a single service and a main executable per platform. Task execution is driven by this service and its child processes.

Windows

• Service name: Binalyze AIR Agent Service
• Main executable: AIR.exe

Linux

• Service name: Binalyze.AIR.Agent
• Main executable: air

macOS

• Service name: com.binalyze.air-agent
• Main executable: air

Processes by Task Type

The tables below list the processes spawned for each task type. Executable names are shown as Windows / Linux · macOS where they differ. All listed processes run as child processes of the AIR Responder and terminate when the task completes.

Acquisition Tasks

Process	Role
AIR.exe / air	Main responder process
TACTICAL.exe / tactical	Evidence collection engine
TACTICAL-Legacy.exe	Legacy evidence collection engine (Windows only; runs when needed for specific evidence types)
osqueryi.exe / osqueryi	Runs only when osquery queries are defined
DRONE.exe / drone	Runs only when DRONE or MITRE ATT&CK Analyzer analysis is enabled

Hunt/Triage Tasks

Process	Role
AIR.exe / air	Main responder process
AIR.exe / air (isolated child process)	Dedicated child process used for scanning
YARA engine	Not a separate executable; runs as part of the scanning process
osqueryi.exe / osqueryi	osquery query execution
DRONE.exe / drone	Runs when the MITRE ATT&CK Analyzer is enabled or SIGMA scanning is performed

Disk Image Tasks

Process	Role
AIR.exe / air	Main responder process

Full Text Search Tasks

Process	Role
AIR.exe / air	Main responder process
magellan.exe / magellan	Full-text search engine; runs for the duration of the task, and temporary working files are cleaned up after the task completes

interACT Tasks

Process	Role
AIR.exe / air	Main responder process
AIR.exe interact / air interact	Separate child process for interactive sessions
curl	Spawned depending on operator commands
osqueryi.exe / osqueryi	Spawned depending on operator commands

Watchdog Process

The Responder includes a separate watchdog component (WATCHDOG.exe / watchdog) that is installed with the agent and runs periodically as part of the Responder’s lifecycle.

The watchdog is not a process dynamically spawned during task execution. Instead, it is a continuous lifecycle component of the Responder that monitors the agent’s health and integrity. For details on how the watchdog protects the Responder, see Responder Tamper Detection.

Important Notes

• All helper processes created during task execution run as child processes of the AIR Responder and terminate automatically when the task completes.
• No task type adds new or persistent services to the operating system.
• All processes are temporary and are cleaned up upon task completion.
• Each endpoint can run only one acquisition or disk image task at a time; other tasks queue automatically.