acquire_baseline
Assign a baseline acquisition task to specific endpoints
LABSCO SUMMARY
The full arc of an endpoint investigation — acquire, triage, isolate, record — runs against a single case.
Cases are the spine here: endpoints, tasks, notes, users and activities all hang off one, and each of those can be exported separately when the investigation has to leave the platform. The destructive tools are scoped rather than broad — uninstall and purge both require an included-endpoint-ID filter instead of accepting a wide match. Two things can be checked before they exist: a triage rule's syntax, and an FTPS, Azure Storage or Amazon S3 repository's configuration.
What it is
A client for a Binalyze AIR deployment spanning assets, evidence acquisition, triage, cases, policies, evidence repositories, organizations and audit logs.
What you get
- Assets listed and inspected with the tasks attached to them, tagged by hand or by auto-tag rules written for Linux, Windows and macOS, and uninstalled with or without purging their data.
- Evidence acquisition: profiles created and listed, acquisition and disk image tasks assigned to endpoints and volumes, baseline acquisition and comparison with a report, and the artifact and e-discovery pattern catalogues.
- Endpoint actions assigned by filter — isolation, reboot, shutdown, log retrieval and version update.
- Triage rules validated for syntax before creation, then created, updated, deleted and assigned as tasks, with triage tags beside them.
- Cases opened, closed, archived and reassigned, carrying notes, endpoints, tasks, users and activity history, each exportable on its own, with a name-collision check before creation.
- Evidence repositories on SMB, SFTP, FTPS, Azure Storage and Amazon S3, with FTPS, Azure and S3 configurations validated before they are saved.
- Policies with storage, compression and filter settings, priority ordering and match statistics; organizations with users, tags, deployment tokens and shareable deployment settings; audit logs listed and exported; task assignments cancelled or deleted; and task reports and PPC files downloaded.
Requirements
A Binalyze AIR deployment you can reach, with its host in AIR_HOST and an API token in AIR_API_TOKEN, held by an account entitled to the actions you intend — isolation, uninstall and purge among them.
Setup effort
One command plus a key — npx -y @binalyze/air-mcp, then supply credentials
USE CASES
01
Collecting evidence from a suspect endpoint before it is lost
The profile decides what is collected; the task carries it to named endpoints, and the artifact catalogue is what the profile is built from.
02
Cutting a compromised machine off the network
Isolation is assigned like any other task, which means it is also trackable and cancellable like one.
03
Sweeping a fleet for a single indicator
Validating the rule before it exists is what stops a bad expression from being pushed to every endpoint.
04
Holding an investigation together as one record
Endpoints, tasks, notes and activity all attach to the case, and each of them can leave the platform separately when a report is due.
05
Telling what changed on a machine since it was known good
A baseline is only useful against a later one; the comparison report is the artefact an investigator actually reads.
06
Sending evidence to storage you control
Validating the configuration before saving it avoids discovering the credentials were wrong at the moment evidence is being written.
116 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
add_note_to_case
Add a note to a specific case by its ID
add_tags_to_assets
Add tags to specific assets based on filters. Requires specifying filter.includedEndpointIds and tags.
add_tags_to_organization
Add tags to an organization
archive_case_by_id
Archive a case by its ID
assign_acquisition_task
Assign an evidence acquisition task to specific endpoints
assign_image_acquisition_task
Assign a disk image acquisition task to specific endpoints and volumes
assign_isolation_task
Assign an isolation task to specific endpoints
assign_log_retrieval_task
Assign a log retrieval task to specific endpoints
assign_reboot_task
Assign a reboot task to specific endpoints
assign_shutdown_task
Assign a shutdown task to specific endpoints
assign_triage_task
Assign a triage task to endpoints based on filter criteria
assign_users_to_organization
Assign users to a specific organization
assign_version_update_task
Assign a version update task to specific endpoints
call_webhook
Call a webhook with the specified parameters
cancel_task_assignment
Cancel a task assignment by its ID
cancel_task_by_id
Cancel a specific task by its ID
change_case_owner
Change the owner of a case
check_case_name
Check if a case name is already in use
check_organization_name_exists
Check if an organization name already exists in the system
close_case_by_id
Close a case by its ID
compare_baseline
Compare baseline acquisition tasks for a specific endpoint
create_acquisition_profile
Create a new acquisition profile
create_amazon_s3_repository
Create a new Amazon S3 repository for evidence storage
create_auto_asset_tag
Create a new rule to automatically tag assets based on specified conditions for Linux, Windows, and macOS.
create_azure_storage_repository
Create a new Azure Storage repository
create_case
Create a new case in the system
create_ftps_repository
Create a new FTPS evidence repository
create_organization
Create a new organization
create_policy
Create a new policy with specific storage and compression settings
create_sftp_repository
Create a new SFTP evidence repository
create_smb_repository
Create a new SMB evidence repository
create_triage_rule
Create a new triage rule
create_triage_tag
Create a new triage rule tag
delete_auto_asset_tag_by_id
Delete a specific auto asset tag rule by its ID
delete_note_from_case
Delete a note from a case by its ID
delete_organization
Delete an organization by its ID
delete_policy_by_id
Delete a specific policy by its ID
delete_repository
Delete an evidence repository by its ID
delete_tags_from_organization
Delete specific tags from an organization
delete_task_assignment
Delete a specific task assignment by its ID
delete_task_by_id
Delete a specific task by its ID
delete_triage_rule
Delete an existing triage rule by ID
download_case_ppc
Download a PPC file for a specific endpoint and task
download_task_report
Download a task report for a specific endpoint and task
export_audit_logs
Initiate an export of audit logs from the AIR system
export_case_activities
Export activities for a specific case by its ID
export_case_endpoints
Export endpoints for a specific case by its ID
export_case_notes
Export notes for a specific case by its ID
export_cases
Export cases data from the system
get_acquisition_profile_by_id
Get details of a specific acquisition profile by its ID
get_asset_by_id
Get detailed information about a specific asset by its ID
get_asset_tasks_by_id
Get all tasks associated with a specific asset by its ID
get_auto_asset_tag_by_id
Get details of a specific auto asset tag rule by its ID
get_case_activities
Get activity history for a specific case by its ID
get_case_by_id
Get detailed information about a specific case by its ID
get_case_endpoints
Get all endpoints associated with a specific case by its ID
get_case_tasks_by_id
Get all tasks associated with a specific case by its ID
get_case_users
Get all users associated with a specific case by its ID
get_comparison_report
Get comparison result report for a specific endpoint and task
get_organization_by_id
Get detailed information about a specific organization by its ID
get_organization_users
Get users for a specific organization by its ID
get_policy_by_id
Get detailed information about a specific policy by its ID
get_policy_match_stats
Get statistics on how many endpoints match each policy based on filter criteria
get_report_file_info
Get information about a PPC file for a specific endpoint and task
get_repository_by_id
Get detailed information about a specific evidence repository by its ID
get_shareable_deployment_info
Get shareable deployment information using a deployment token
get_task_assignments
Get all assignments for a specific task by its ID
get_task_assignments_by_id
Get all assignments associated with a specific task by its ID
get_task_by_id
Get detailed information about a specific task by its ID
get_triage_rule_by_id
Get a specific triage rule by its ID
get_user_by_id
Get detailed information about a specific user by their ID
import_task_assignments_to_case
Import task assignments to a specific case
list_acquisition_artifacts
List all acquisition artifacts available for evidence collection
list_acquisition_profiles
List all acquisition profiles in the system
list_assets
List all assets in the system
list_audit_logs
List audit logs from the AIR system
list_auto_asset_tags
List all auto asset tag rules in the system.
list_cases
List all cases in the system
list_drone_analyzers
List all drone analyzers in the system
list_e_discovery_patterns
List all e-discovery patterns for file type detection
list_organizations
List all organizations in the system
list_policies
List all policies in the system
list_repositories
List all evidence repositories in the system
list_tasks
List all tasks in the system
list_triage_rules
List all triage rules in the system
list_triage_tags
List all triage rule tags in the system
list_users
List all users in the system
open_case_by_id
Open a previously closed case by its ID
post_webhook
Post data to a webhook
purge_and_uninstall_assets
Purge data and uninstall specific assets based on filters. Requires specifying filter.includedEndpointIds.
remove_endpoints_from_case
Remove endpoints from a case based on specified filters
remove_tags_from_assets
Remove tags from specific assets based on filters. Requires specifying filter.includedEndpointIds and tags.
remove_task_assignment_from_case
Remove a specific task assignment from a case
remove_user_from_organization
Remove a user from an organization
start_tagging
Start the auto asset tagging process for assets matching filter criteria.
uninstall_assets
Uninstall specific assets based on filters without purging data. Requires specifying filter.includedEndpointIds.
update_amazon_s3_repository
Update an existing Amazon S3 repository
update_auto_asset_tag
Update an existing auto asset tag rule.
update_azure_storage_repository
Update an existing Azure Storage repository
update_banner_message
Update the system banner message settings
update_case
Update an existing case by ID
update_ftps_repository
Update an existing FTPS evidence repository
update_note_in_case
Update an existing note in a specific case
update_organization_by_id
Update an existing organization by ID
update_organization_deployment_token
Update the deployment token for a specific organization
update_organization_shareable_deployment
Update an organization's shareable deployment settings
update_policy
Update an existing policy with specific storage and filter settings
update_policy_priorities
Update the priority order of policies
update_sftp_repository
Update an existing SFTP repository
update_smb_repository
Update an existing SMB repository by ID
update_triage_rule
Update an existing triage rule by ID
validate_amazon_s3_repository
Validate Amazon S3 repository configuration
validate_azure_storage_repository
Validate an Azure Storage repository configuration
validate_ftps_repository
Validate FTPS repository configuration without creating it
validate_triage_rule
Validate a triage rule syntax without creating it
BEFORE YOU INSTALL
What to know first
Tools you get
116 tools when we connected. The documentation describes listing acquisition evidences, but no tool does that; list_acquisition_artifacts is the closest.
Requires
- npx on PATH
- Node.js 18 or later
- A Binalyze AIR deployment you can reach, with its API host in AIR_HOST
- AIR_API_TOKEN in your environment
Where it runs
Both documented clients run the server on your machine.
CONTEXT COST
Heavy Standing cost
Rated by the size of the 116 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @binalyze/air-mcpMCP Clients
Claude Desktop, Cursor
JSON
{
"mcpServers": {
"air-mcp": {
"command": "npx",
"args": [
"-y",
"@binalyze/air-mcp"
],
"env": {
"AIR_HOST": "<YOUR_AIR_HOST>",
"AIR_API_TOKEN": "<YOUR_AIR_API_TOKEN>"
}
}
}
}
