Assets
Responder Updates
Section titled “Responder Updates”Manage how AIR Responders on your assets receive version updates.
Under Settings → Assets → Responder Updates, you can:
- Choose Manual Updates (assign an upgrade task) or Automatic Updates
- Configure the Default policy schedule used when no custom policy matches
- Create custom update policies and exclusion policies based on asset filters
- Review matching assets before you save
To assign an immediate or scheduled update task to one or more assets, see How do I update Responders on assets?.
For the complete model—including policy precedence, manual exclusions, schedules, and troubleshooting—see Responder Updates. To read the update state of an individual asset, see Responder Update Status. To review past attempts, see Responder Update History.
Tamper Detection
Section titled “Tamper Detection”Enable alerts for tampering attempts on responders.
- When Tamper Detection is enabled, the responder will actively monitor its own operation for any interference or attempts to disable it.
- Functionality: If there is an attempt to modify or interfere with the responder (e.g., by disabling it or altering its files), the responder will notify the AIR Console, ensuring that any malicious attempts are flagged immediately.
- This feature is critical for ensuring the integrity and continuous operation of responders in high-security environments.
- For details, see Responder Tamper Detection.
Uninstall Protection
Section titled “Uninstall Protection”Prevent unauthorized uninstallation of responders by requiring a Console-generated uninstall code.
- When this feature is enabled, users must supply a valid uninstall code to uninstall the responder from an asset. This prevents unauthorized personnel from removing the responder, which could otherwise leave the asset vulnerable or unmonitored.
- Uninstallation Method: Manual uninstallation is restricted to shell commands, meaning the responder can’t be removed via a simple GUI or file system manipulation, adding an extra layer of security.
- Managing codes: Use New Code to generate a Console-wide uninstall code (valid for approximately 30 days) and Revoke All Codes to rotate the signing key and invalidate all previously generated codes. Console-initiated uninstall tasks do not require a manual code.
- For details, see Uninstalling Responders.
Active Directory (AD) Integration
Section titled “Active Directory (AD) Integration”Synchronize assets from Active Directory with AIR.
- This feature allows AIR to integrate with your Active Directory (AD) environment. You can specify the AD server (e.g., 10.0.0.1) and the domain (e.g., company.local) to automatically synchronize information about computers and users from AD into AIR.
- LDAP Synchronization: By manually starting the LDAP synchronization, you can query Active Directory for specific objects such as computers, ensuring that AIR can discover and manage assets from your organization’s AD.
- The Query For Computers field (e.g.,
(&(objectCategory=computer))) uses an LDAP filter to query and sync only computer objects from the directory. - Authentication: You will need to provide an AD username and password to authenticate and pull information from the directory.