Binalyze AIR
Binalyze AIR is a digital forensics and incident response platform that combines security signals, forensic evidence, and AI-driven analysis for SOC investig…
What Binalyze AIR is
Binalyze AIR is a digital forensics and incident response platform that combines security signals, forensic evidence, and AI-driven analysis for SOC investigations. It collects more than 1,000 types of evidence across platforms, and its DRONE component analyzes that evidence with built-in analyzers and detections. Teams can also hunt with custom osquery, YARA, and Sigma rules. A shared workspace brings evidence, findings, notes, and timelines together for an investigation. AIR connects with SIEM, EDR, XDR, and SOAR platforms through integrations, APIs, and webhooks, including alert-triggered evidence collection. Named connections include Splunk, IBM QRadar, Wazuh, Cortex XSOAR, Slack, CrowdStrike, Microsoft Sentinel, and ServiceNow. Binalyze says SHA-256 hashing and RFC3161 timestamp certificates help support chain of custody. AIR supports hybrid deployment and Linux self-hosting; responders support Windows, Linux, and macOS. Pricing is on request, and a free trial is offered.
Good
- Collects more than 1,000 evidence types.
- Supports custom osquery, YARA, and Sigma rules.
- Shared workspace includes evidence, notes, and timelines.
- Connects to SIEM, EDR, XDR, and SOAR platforms.
- Free trial is available.
Watch out
- Pricing is available on request.
- No trial duration is stated.
- Linux self-hosting requires Linux deployment.
Who it suits
AIR is suited to SOC analysts, threat hunters, and detection engineers who need to investigate beyond alerts. It also fits teams seeking shared investigations, evidence collection, and hunting across an environment.
Verdict
Binalyze AIR combines broad evidence collection, automated analysis, hunting, and investigation collaboration in one platform. Teams should request pricing and confirm whether its deployment options suit their environment.
Plans and prices
From Binalyze AIR's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Binalyze AIR | Priced on request | Pricing not displayed on the pages reviewed; contact Binalyze |
The facts
Each one read from Binalyze AIR's own pages, with the date it was checked.
What it does
- Analysis
- DRONE automatically analyzes forensic evidence using built-in analyzers and detections.checked 30 Sep 2026
- Automated analysis
- DRONE automatically analyzes forensic evidence using built-in analyzers and detections.checked 30 Sep 2026
- Deployment claims
- The trial page says AIR can be deployed in 10 minutes and an investigation started in 15 minutes.checked 30 Sep 2026
- Evidence collection
- AIR collects more than 1,000 types of evidence across a range of platforms.checked 30 Sep 2026
- Evidence integrity
- Binalyze says AIR uses SHA-256 hashing and RFC3161 digital timestamp certificates to support chain of custody.checked 30 Sep 2026
- Hunting
- AIR supports custom osquery, YARA, and Sigma rules for hunting across an environment.checked 30 Sep 2026
- Integration methods
- AIR supports open APIs, webhooks, and pre-built integrations to connect with SIEM, EDR, XDR, and orchestration platforms.checked 30 Sep 2026
- Integrations
- AIR connects to SIEM, EDR, XDR, and SOAR platforms using built-in integrations, APIs, and custom webhooks to trigger evidence collection when alerts fire.checked 30 Sep 2026
- Intended users
- The maker names SOC analysts, threat hunters, and detection engineers as users who need to investigate beyond alerts.checked 30 Sep 2026
- Investigation workspace
- AIR brings evidence, findings, notes, and timelines into a shared investigation workspace.checked 30 Sep 2026
- Named integrations
- Listed integrations include Splunk, IBM QRadar, Wazuh, Cortex XSOAR, Slack, CrowdStrike, Microsoft Sentinel, and ServiceNow.checked 30 Sep 2026
- Purpose
- Binalyze AIR combines security signals with forensic evidence and AI-driven analysis to help SOC teams investigate risk and make decisions.checked 30 Sep 2026
- Self-hosted deployment
- AIR can be deployed on Linux using a single-tier or two-tier model; the maker describes two-tier deployment as suited to production and capable of supporting tens of thousands of assets or endpoints.checked 30 Sep 2026
- Supported endpoint operating systems
- AIR release notes describe evidence acquisition and disk imaging for Windows, Linux, and macOS.checked 30 Sep 2026
- Supported responder systems
- The AIR responder can be installed on Microsoft Windows, Linux, and Apple macOS.checked 30 Sep 2026
- Target users
- The website names SOC analysts, threat hunters, and detection engineers as users who need to investigate beyond alerts.checked 30 Sep 2026
- Threat hunting
- AIR supports hunting with built-in analyzers and custom osquery, YARA, and Sigma rules.checked 30 Sep 2026
- Use cases
- The company describes threat hunting, alert triage, reactive investigations, and compliance and audit readiness as AIR use cases.checked 30 Sep 2026
- What it does
- AIR combines security signals with forensic evidence and AI-driven analysis to help SOC teams investigate risk and make decisions.checked 30 Sep 2026
The company
- Company
- Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia, with a global presence in the UK, US, and Singapore.checked 30 Sep 2026
- Company history
- Binalyze says it was established in 2018 and is headquartered in Tallinn, Estonia.checked 30 Sep 2026
- Founded
- 2018checked 28 Sep 2026
- Headquarters
- Tallinn, Estoniachecked 28 Sep 2026
Money
- Trial
- The maker offers a free trial and says AIR can be deployed in 10 minutes; no trial duration is stated on the page.checked 30 Sep 2026
Alternatives to Binalyze AIR
- 1
DFIR-IRIS
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 2
DFIRe
Free planWebAPILinuxSelf-hosted7.5From €9,900 a year - 3
Forensicator
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 4
LimaCharlie
Free planWebAPILinuxmacOS7.2$3 usage-based - 5
Forendi
WebAPILinuxmacOS6.6From $199 a month - 6
Belkasoft X Forensic
AndroidiOSLinuxmacOS6.5