Freedom251 › Incident Response Software
Binalyze AIR
What Binalyze AIR is
Binalyze AIR is a digital forensics and incident response platform for SOC teams. It combines security signals, forensic evidence, and AI-driven analysis to help investigate risk and make decisions. AIR collects more than 1,000 types of evidence across platforms, while DRONE applies built-in analyzers and detections to analyze forensic evidence. Teams can hunt using custom osquery, YARA, and Sigma rules. A shared workspace brings evidence, findings, notes, and timelines into an investigation. AIR connects with SIEM, EDR, XDR, and SOAR platforms through integrations, APIs, and webhooks, including alert-triggered evidence collection. Named integrations include Splunk, IBM QRadar, Wazuh, Cortex XSOAR, Slack, CrowdStrike, Microsoft Sentinel, and ServiceNow. Binalyze says SHA-256 hashing and RFC3161 digital timestamp certificates support chain of custody. AIR offers Linux self-hosting in single-tier or two-tier configurations, and responders can be installed on Windows, Linux, and macOS. The product is paid, pricing is on request, and a free trial is available. Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia.
Who it suits
AIR is intended for SOC analysts, threat hunters, and detection engineers investigating activity beyond alerts. Its shared workspace and hunting rules also suit teams coordinating forensic investigations.
What it does well
- Collects more than 1,000 types of evidence.
- DRONE analyzes evidence with built-in analyzers and detections.
- Supports custom osquery, YARA, and Sigma rules.
- Free trial is available.
What to know first
- Pricing is on request.
- Self-hosted deployment is on Linux.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Binalyze AIR | Pricing not displayed on the pages reviewed; contact Binalyze | On request |
As binalyze.ai lists them, read 30 Sept 2026. The maker's own page has the final word.
Getting started
- Visit https://binalyze.ai/.
- Request pricing for the paid AIR plan.
- Start the free trial.
- Choose a hybrid deployment or deploy on Linux using a single-tier or two-tier model.
- Install the AIR responder on Windows, Linux, or macOS systems.
Verdict
Binalyze AIR combines evidence collection, automated analysis, hunting, and shared case context for security investigations. Teams considering it should note that pricing requires contacting the company.
Questions
How much does Binalyze AIR cost?
AIR is paid, and pricing is available on request.
Does AIR have a free plan or trial?
A free trial is offered. No trial duration is stated.
Which platforms does AIR support?
The listed platforms are API, Linux, macOS, self-hosted, web, and Windows. Responders can be installed on Windows, Linux, and macOS.
Can AIR be self-hosted?
Yes. AIR can be deployed on Linux with a single-tier or two-tier model.
Which integrations does AIR include?
Named integrations include Splunk, IBM QRadar, Wazuh, Cortex XSOAR, Slack, CrowdStrike, Microsoft Sentinel, and ServiceNow. AIR also supports APIs and custom webhooks.
Who makes Binalyze AIR?
Binalyze, established in 2018 and headquartered in Tallinn, Estonia, makes AIR.
Facts from Binalyze AIR's own pages
- Analysis
- DRONE automatically analyzes forensic evidence using built-in analyzers and detections. · binalyze.ai, 30 Sept 2026
- Automated analysis
- DRONE automatically analyzes forensic evidence using built-in analyzers and detections. · binalyze.ai, 30 Sept 2026
- Company
- Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia, with a global presence in the UK, US, and Singapore. · binalyze.ai, 30 Sept 2026
- Company history
- Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia. · binalyze.ai, 30 Sept 2026
- Deployment claims
- The trial page says AIR can be deployed in 10 minutes and an investigation started in 15 minutes. · binalyze.ai, 30 Sept 2026
- Evidence collection
- AIR collects more than 1,000 types of evidence across a range of platforms. · binalyze.ai, 30 Sept 2026
- Evidence integrity
- Binalyze says AIR uses SHA-256 hashing and RFC3161 digital timestamp certificates to support chain of custody. · kb.binalyze.ai, 30 Sept 2026
- Founded
- 2018 · binalyze.ai, 28 Sept 2026
- Headquarters
- Tallinn, Estonia · binalyze.ai, 28 Sept 2026
- Hunting
- AIR supports custom osquery, YARA, and Sigma rules for hunting across an environment. · binalyze.ai, 30 Sept 2026
- Integration methods
- AIR supports open APIs, webhooks, and pre-built integrations to connect with SIEM, EDR, XDR, and orchestration platforms. · binalyze.ai, 30 Sept 2026
- Integrations
- AIR connects to SIEM, EDR, XDR, and SOAR platforms using built-in integrations, APIs, and custom webhooks to trigger evidence collection when alerts fire. · binalyze.ai, 30 Sept 2026
- Intended users
- The maker names SOC analysts, threat hunters, and detection engineers as users who need to investigate beyond alerts. · binalyze.ai, 30 Sept 2026
- Investigation workspace
- AIR brings evidence, findings, notes, and timelines into a shared investigation workspace. · binalyze.ai, 30 Sept 2026
- Named integrations
- Listed integrations include Splunk, IBM QRadar, Wazuh, Cortex XSOAR, Slack, CrowdStrike, Microsoft Sentinel, and ServiceNow. · binalyze.ai, 30 Sept 2026
- Purpose
- Binalyze AIR combines security signals with forensic evidence and AI-driven analysis to help SOC teams investigate risk and make decisions. · binalyze.ai, 30 Sept 2026
- Self-hosted deployment
- AIR can be deployed on Linux using a single-tier or two-tier model; the maker describes two-tier deployment as suited to production and capable of supporting tens of thousands of assets or endpoints. · kb.binalyze.ai, 30 Sept 2026
- Supported endpoint operating systems
- AIR release notes describe evidence acquisition and disk imaging for Windows, Linux, and macOS. · marketing.binalyze.com, 30 Sept 2026
- Supported responder systems
- The AIR responder can be installed on Microsoft Windows, Linux, and Apple macOS. · kb.binalyze.ai, 30 Sept 2026
- Target users
- The website names SOC analysts, threat hunters, and detection engineers as users who need to investigate beyond alerts. · binalyze.ai, 30 Sept 2026
- Threat hunting
- AIR supports hunting with built-in analyzers and custom osquery, YARA, and Sigma rules. · binalyze.ai, 30 Sept 2026
- Trial
- The maker offers a free trial and says AIR can be deployed in 10 minutes; no trial duration is stated on the page. · binalyze.ai, 30 Sept 2026
- Use cases
- The company describes threat hunting, alert triage, reactive investigations, and compliance and audit readiness as AIR use cases. · binalyze.ai, 30 Sept 2026
- What it does
- AIR combines security signals with forensic evidence and AI-driven analysis to help SOC teams investigate risk and make decisions. · binalyze.ai, 30 Sept 2026
Where Binalyze AIR stands on Freedom251
- Incident Response Software#12 of 21