Post-Deployment Configuration Guide

This document has two parts: The first is a guide to the key post-deployment configuration settings available after installing the AIR console.

The second part is a prioritized checklist of settings to review and adjust based on your specific needs.

PART 1

AIR Post-Deployment Configuration Guide

After installing the AIR console, an Organization is automatically created to help structure and manage your assets and cases. Your next step should be to navigate to the settings in the upper right corner of the console to configure your deployment according to your organization’s requirements.

If you’re using AIR to support multiple customers or tenants, this is also the time to create and set up additional organizations for each customer. Additional tenants can be added at any time as your needs evolve.

These settings also provide important information, such as the Deployment Token, Shareable Deployment Page URL, and options to add a Relay Server or manage specific users.

For MSSPs, a new Organization should be created for each client engagement. Enterprise clients may only need one Organization but can create additional ones if required.

2. Single Sign-On (SSO)

Using Single Sign-On (SSO) is optional in AIR but is available for those who want to implement it. You can integrate with either:

• Azure AD: Azure Integration Guide
• Okta SSO: Okta SAML 2.0 SSO Integration

For more details, visit the SSO Integrations Guide.

3. Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is not required if SSO is implemented. However, if you are not using SSO and wish to utilize the built-in remediation capability, interACT, enabling 2FA is mandatory. Enabling 2FA is also recommended to strengthen user account protection and general security.

4. Responder Management & Updates

The Assets Summary window on the home page of the AIR UI will show assets to be in either one of 2 states:

• Managed: The asset’s responder has been successfully deployed to the device and is ready to collect tasking assignments from the console.
• Unmanaged: The asset is discovered by enumerating Active Directory but does not have the AIR responder deployed.

The Assets Summary will also report the asset as:

• Off-Network: Responder has supplied data to the console via an Off-Network Acquisition or Hunt/Triage task.
• Unreachable: The asset’s responder is currently unreachable. If an Asset’s responder fails to connect to the AIR console for over 30 days, its status changes to “unreachable.” Until then, its status will be managed as online or offline.
• Update Required: The responder on the asset requires an update to function correctly.
• Update Advised: The responder is still functional but for full functionality, an update is recommended.
• Isolated: The asset is currently isolated from the network apart from communication with the AIR console only.

Responders deployed to assets can be updated in three ways:

1. Manual Updates: Assign an upgrade task to specific assets.
2. Automatic Updates: Configure automatic updates for all deployed Responders.
3. SCCM

5. Create Exception Rules for AIR in EDR/AV Systems

To ensure seamless operation and maximize the effectiveness of AIR in your investigations, it is important to allow-list AIR components in your security tools. AIR collects and analyzes extensive forensic data from assets, which may involve activities like executing binaries, creating temporary files, and accessing sensitive directories. These actions can trigger alarms in EDR or AV solutions, potentially disrupting or slowing down forensic investigations. Configuring exception rules for AIR in your security systems, prevents such interference, ensuring fast and complete evidence acquisition without compromising the investigation process.

Visit this page for the full list of items to exclude: AIR Responder Exception Rules

Visit this page for information about AIR Network Communication and Firewall Rules.

6. Evidence Repositories

AIR allows you to store collected evidence either on the local machine where the task was executed or in external repositories. Supported external storage options include:

• SMB
• SFTP
• FTPS
• AWS S3
• Azure Blob

For cloud-based deployments, it is recommended to use cloud-based repositories like AWS S3, Azure Blob, or Google Cloud Storage instead of SMB, SFTP, or FTPS. More details can be found in the Evidence Repositories Guide.

7. Assets

AIR-supported assets include traditional computers, workstations, and servers running Windows, Linux, IBM AIX, or macOS, as well as off-network or cloud-based systems (e.g., AWS EC2 and Azure VMs) running the same operating systems.

Disk images (e.g., RAW, VMDK, E01, Ex01) are also supported for importing into the AIR File Explorer.

After creating an Organization, deploy AIR Responders to assets. Note that assets are associated with a single Organization but can appear in multiple Cases.

For deployment instructions, refer to the AIR Responder Deployment Guide.

8. Cases

Cases in AIR manage acquisitions, triages, interACT sessions, comparisons, scheduled tasks, case notes, and assigned users. Cases with no tasks performed will appear empty, while active cases will display relevant data and activities.

One of the Case Assets ‘Action Buttons’ will launch the Investigation Hub for that case.

9. Libraries

Libraries in AIR store reusable resources like acquisition profiles, triage rules, interACT files, and more, ensuring easy access and consistency across investigations. Now is the time to create, upload, and configure your triage rules for efficient threat hunting, fine-tune your acquisition profiles, and add any Auto Asset Tags you want to apply during responder deployment.

10. Integrations (Automation)

AIR supports automation through integrations, including:

• API Tokens: API Documentation
• Webhooks (Triggers): Webhooks Documentation

11. Hunt/Triage

Hunt/Triage functionality allows for quick and effective threat hunting across assets. For more information, see the Hunt/Triage Guide.

12. Auto Asset Tagging

The Auto Asset Tagging task will run immediately after Responders are installed, this helps organize and manage assets within AIR. It automates the tagging process based on predefined rules.

The process, along with manual tagging, can also be executed on-demand at a later time for individual or multiple assets.

Details can be found in the Auto Asset Tagging Guide.

13. Policies

AIR policies allow you to configure settings such as:

• Saving collected evidence to a local repository or external repository.
• Sending files collected by interACT to a download location or evidence repository.
• Resource limits for CPU, bandwidth, and disk space.
• Enabling compression and encryption.
• Configuring IP, port, and process allow lists for isolation policies.

For more information, see the Policies Guide.

14. Additional Configurations

Additional configurations that may be necessary include:

Console Proxy Settings

• When using web proxies, configure the AIR console with the correct proxy and SSL/TLS settings. Administrators can enter proxy details (IP, port, username, password) and import SSL/TLS certificates in PEM, DER, or PKCS formats.

Tamper Detection and Uninstallation Password

• With Tamper Detection switched on, the Responder will notify AIR of attempts to interfere with its normal operation.

Chain of Custody using RFC3161 Timestamping

• The RFC3161 timestamping feature provides proof that the data existed at a particular moment in time and when combined with hashing that it has not changed.

SMTP Server Configuration

• Specifying an SMTP server will allow AIR to send password-reset emails to users.

Syslog/SIEM Integration

• Integrate with Syslog or SIEM systems for centralized audit logging. Ensure both TCP and UDP protocols are configured correctly.
• Logs from AIR should be forwarded to ensure security monitoring and compliance tracking.

AI Assistant Integration

• AI Assistant is a chat-based AI helper for DFIR workflows. It can be toggled on or off. Self-hosted customers must provide their own OpenAI API key under Settings > Features > AI Assistant.

Users and Roles Management

• AIR enables the creation of users and their assignment to specific Roles and Organizations. Roles offer granular control, with 109 adjustable privileges

Backup Settings

• Configure database backup settings. Schedule regular backups or run an instant backup. View your backup history and statuses.

Active Directory Integration

• Integrate Active Directory to mirror your organizational structure. This simplifies management by grouping assets based on AD units.
• Validate that assets are correctly categorized and managed through AD synchronization.
• This integration also allows authorized users to log in to AIR using their Active Directory credentials.

PART 2

AIR setup Checklist

Following on from the AIR Post-Deployment Configuration Guide above, here is a prioritized checklist to ensure thorough configuration before operational use:

Priority 1: Core Setup

1. Organization Setup

Check/Configure your Organization settings in the Main Menu.

For MSSPs, set up a new Organization for each client. For enterprises, ensure the appropriate organizational structure is established.

2. Console Proxy Settings

Check/configure proxy server settings if using web proxies within your network.

3. Check the Health of Docker Containers

Run sudo docker ps to list all active Docker containers and check their current status, identifying any that aren’t running as expected.

4. Responder Deployment

Deploy AIR Responders to all assets (Windows, Linux, macOS, IBM AIX, Cloud Systems).

Check the status of assets and ensure they are connected and associated with the correct Organization(s).

Create Exception Rules for AIR in EDR/AV Systems.

5. Active Directory Integration

Integrate AD to mirror your organizational structure.

Validate AD synchronization and ensure assets are categorized correctly.

6. Users and Roles Management

Configure roles with appropriate privileges for granular control.

Create users and assign them to roles and organizations.

7. Case Management

Set up a Case(s) to manage your investigations these will act as containers for tasks such as acquisitions, triages, interACT sessions, and scheduled tasks.

Assign users to specific cases.

8. Evidence Repository Configuration

Configure external repositories (SMB, SFTP, FTPS, AWS S3, Azure Blob, Google Cloud Storage) to store collected evidence.

Prefer cloud-based repositories for cloud deployments.

9. Backup Configuration

Schedule regular backups of the AIR database.

Validate backup settings and review backup history.

Consider an approach for backing up AIR audit logs which the system will only keep for 3 months.

Priority 2: Security Enhancements

1. Single Sign-On (SSO)

Optional: Configure SSO using Azure AD or Okta for centralized authentication.

2. Two-Factor Authentication (2FA)

Enable 2FA for users if SSO is not implemented, especially if using interACT.

3. Tamper Detection and Uninstallation Password

Enable tamper detection to monitor for unauthorized interference with Responders (It is off by default).

Set an uninstallation password to prevent unauthorized removal of Responders.

4. SSL/TLS Configuration

Configure proxy server and SSL/TLS settings, including importing necessary certificates.

5. SMTP Server Configuration

Set up an SMTP server to enable AIR to send password reset and other critical emails.

6. Chain of Custody using RFC3161 Timestamping

Enable RFC3161 timestamping to ensure data integrity and proof of existence.

Priority 3: Automation and Advanced Features

1. AI Assistant Integration

Enable or disable AI Assistant, the chat-based AI helper for DFIR workflows. Self-hosted customers must provide their own OpenAI API key.

2. API and Webhook Integrations

Set up API tokens for automation and Webhooks (Triggers) for real-time event management. (The API is the recommended method for integration, preferred over Webhooks for most use cases)

3. Auto Asset Tagging

Configure Auto Asset Tagging to organize and manage assets efficiently.

4. Hunt/Triage Library Setup

Enable, write, upload, and configure your triage rules in AIR Libraries for efficient threat hunting.

5. Policy Management

Establish and configure policies for evidence storage, resource limits, encryption, and isolation settings.

6. Syslog/SIEM Integration

Integrate AIR with Syslog or SIEM systems for centralized audit logging and monitoring.

Priority 4: Ongoing/regular checks

1. Version Updates

New releases generally occur once or twice a month - be sure to use the most up-to-date version to ensure the best feature sets, fixes, and performance.

2. Responder Health

Use the Assets Summary widget on the Home page to manage the status of your deployed responders.

3. AIR Audit Logs Backup

AIR audit logs are saved to the console’s PostgreSQL database and retained for 3 months after which they are deleted, so please arrange to back them up if required. Please see this KB page to learn more

This prioritized checklist ensures that your AIR instance is fully configured and optimized for operational use, covering core setup, security enhancements, automation, and advanced features.