Binalyze AIR

Spec sheet

What it does

AIR combines security signals with forensic evidence and AI-driven analysis to help SOC teams investigate risk and make decisions.Read 30 Sep 2026 · binalyze.ai

Purpose

Binalyze AIR combines security signals with forensic evidence and AI-driven analysis to help SOC teams investigate risk and make decisions.Read 30 Sep 2026 · binalyze.ai

Intended users

The maker names SOC analysts, threat hunters, and detection engineers as users who need to investigate beyond alerts.Read 30 Sep 2026 · binalyze.ai

Trial

The maker offers a free trial and says AIR can be deployed in 10 minutes; no trial duration is stated on the page.Read 30 Sep 2026 · binalyze.ai

Integrations

AIR connects to SIEM, EDR, XDR, and SOAR platforms using built-in integrations, APIs, and custom webhooks to trigger evidence collection when alerts fire.Read 30 Sep 2026 · binalyze.ai

Headquarters

Tallinn, EstoniaRead 28 Sep 2026 · binalyze.ai

Founded

2018Read 28 Sep 2026 · binalyze.ai

Company

Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia, with a global presence in the UK, US, and Singapore.Read 30 Sep 2026 · binalyze.ai

Analysis

DRONE automatically analyzes forensic evidence using built-in analyzers and detections.Read 30 Sep 2026 · binalyze.ai

Automated analysis

DRONE automatically analyzes forensic evidence using built-in analyzers and detections.Read 30 Sep 2026 · binalyze.ai

Company history

Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia.Read 30 Sep 2026 · binalyze.ai

Deployment claims

The trial page says AIR can be deployed in 10 minutes and an investigation started in 15 minutes.Read 30 Sep 2026 · binalyze.ai

Evidence collection

AIR collects more than 1,000 types of evidence across a range of platforms.Read 30 Sep 2026 · binalyze.ai

Evidence integrity

Binalyze says AIR uses SHA-256 hashing and RFC3161 digital timestamp certificates to support chain of custody.Read 30 Sep 2026 · kb.binalyze.ai

Hunting

AIR supports custom osquery, YARA, and Sigma rules for hunting across an environment.Read 30 Sep 2026 · binalyze.ai

Integration methods

AIR supports open APIs, webhooks, and pre-built integrations to connect with SIEM, EDR, XDR, and orchestration platforms.Read 30 Sep 2026 · binalyze.ai

Investigation workspace

AIR brings evidence, findings, notes, and timelines into a shared investigation workspace.Read 30 Sep 2026 · binalyze.ai

Named integrations

Listed integrations include Splunk, IBM QRadar, Wazuh, Cortex XSOAR, Slack, CrowdStrike, Microsoft Sentinel, and ServiceNow.Read 30 Sep 2026 · binalyze.ai

Self-hosted deployment

AIR can be deployed on Linux using a single-tier or two-tier model; the maker describes two-tier deployment as suited to production and capable of supporting tens of thousands of assets or endpoints.Read 30 Sep 2026 · kb.binalyze.ai

Supported endpoint operating systems

AIR release notes describe evidence acquisition and disk imaging for Windows, Linux, and macOS.Read 30 Sep 2026 · marketing.binalyze.com

Supported responder systems

The AIR responder can be installed on Microsoft Windows, Linux, and Apple macOS.Read 30 Sep 2026 · kb.binalyze.ai

Target users

The website names SOC analysts, threat hunters, and detection engineers as users who need to investigate beyond alerts.Read 30 Sep 2026 · binalyze.ai

Threat hunting

AIR supports hunting with built-in analyzers and custom osquery, YARA, and Sigma rules.Read 30 Sep 2026 · binalyze.ai

Use cases

The company describes threat hunting, alert triage, reactive investigations, and compliance and audit readiness as AIR use cases.Read 30 Sep 2026 · binalyze.ai

Plans and prices

Every Binalyze AIR plan and price →

Where Specifiction places it

• Incident Response Software#2 of 218.8