Purpose
This guide explains how to configure the Binalyze (AIR) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, browse endpoints and groups, isolate/de-isolate an endpoint, and trigger forensic evidence acquisition or triage runs against Binalyze-managed endpoints directly from a Logsign Incident. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
Prerequisites
- A Binalyze AIR console with API access enabled and reachable from the Logsign server.
- A Binalyze API user/token.
- Use least privilege. If Binalyze AIR supports scoped API roles, grant only endpoint/isolation/acquisition/triage permissions rather than full administrative access.
Step 1: Prepare Binalyze AIR for API Access
- Log in to the Binalyze AIR console with an administrator account.
- Create (or designate) a dedicated account/credential for Logsign to use, and note its username and password.
- Note the console's hostname.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Binalyze, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Binalyze device in Logsign. |
| Host | Yes | Hostname of your Binalyze AIR console. |
| Username | Yes | The account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
Endpoints and groups
- search — full-text search across endpoints.
- get_endpoints — lists endpoints, optionally filtered.
- get_endpoint_by_id — gets endpoint detail by ID.
- sync_endpoints — triggers an endpoint sync.
- get_groups / get_child_groups — lists groups / child groups under a parent.
Isolation
- endpoint_isolation (Containment/Recovery) — isolates or de-isolates one or more endpoints. Args: isolationStatus (true to isolate, false to release), endpointIDs (required).
Tasks and tags
- get_tasks, get_task_by_id, get_endpoint_tasks — list/inspect Binalyze tasks.
- add_a_tag / delete_a_tag — manage tags.
Evidence repositories
- get_evidence_repositories, get_evidence_repository_by_id — list/inspect evidence repositories.
- add_evidence_repository — creates a new evidence repository (args: path required; username, password optional).
Forensic acquisition
- get_acquisition_profiles — lists acquisition profiles.
- acquire_evidence_on_endpoint — runs a forensic acquisition on a specific endpoint. Args (all required): taskName, endpointIDs, acquisitionProfileId, osType (Windows or Linux), path, repositoryId.
- acquire_evidence_on_group — same, scoped to a group instead of specific endpoints.
Triage
- get_triage_rules, get_triage_rule_by_id — list/inspect triage rules.
- add_triage_rule — creates a triage rule. Args (all required): description, rule, searchIn (filesystem, memory, or both).
- perform_triage_on_endpoint / perform_triage_on_group — runs triage against specific endpoints or a group. Args required: taskName, endpointIDs (or group), triageRuleIds; optional: cpuLimit.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password. | Re-enter the Username and Password fields and confirm the account can log in to the Binalyze console directly. |
| 403 Forbidden | The account's role does not permit the action being called. | Confirm the account's assigned role in Binalyze AIR covers isolation, acquisition, and triage actions. |
| 429 Too Many Requests | Binalyze AIR enforces API rate limits. | Reduce the frequency of automated calls. |
| acquire_evidence_on_endpoint / perform_triage_on_endpoint fails to find endpoints | Wrong endpointIDs, or the target endpoints are offline. | Use get_endpoints or get_endpoint_by_id to confirm the endpoint IDs and their online status before triggering acquisition or triage. |
Notes and Limits
- Acquisition and triage jobs run asynchronously on Binalyze's side; use get_tasks / get_endpoint_tasks to track their progress and completion.
- The exact console navigation path for creating a dedicated API account was not independently verified against a live Binalyze AIR console during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.