How to Automatically Tag Your Assets During an Investigation

How many Web Servers, Mail Servers, Domain Controllers, and other critical assets do you have on your network or the network you have been asked to investigate? More often than not, nobody can answer this question quickly and this slows down the incident response.

Binalyze AIR now comes with a unique new feature called Auto Asset Tagging that gives total clarity on your endpoint assets in just a few seconds as part of the normal deployment process.

Immediately group critical assets into separate tagged groups in AIR so you can focus your investigation and get to work faster for evidence acquisition, triage, compromise assessment, and timeline.

Predefined asset tags for IIS Web Servers, Web Servers, Mail Servers, MSSQL Servers, and Domain Controllers are included in AIR by default. However, the Auto Asset Tagging tool is completely customizable allowing you to create unlimited other tags using easy to configure rules.

How to create a new auto-asset tagging rule?

Navigate to the Auto-Asset Tagging section in Settings, click on “New tag” and give it a unique name.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

Use any combination of the process, file and directory conditions to specify your new rule.

Once you are happy with the configuration, turn on the new asset tag and AIR will automatically assign a new task on your endpoints and tag endpoints that match the rule. 

Why is auto-asset tagging so important?

Auto Asset Tagging helps you speed up the investigation process by giving you visibility of the network assets in an automated way. In addition, it opens up many other creative possibilities by using custom Auto Asset Tags to look for very unique conditions and even the presence of individual files that might be an indicator of compromise.

Auto Asset Tagging gets really powerful when used in a proactive way. Consider scheduling regular evidence acquisitions or compromise assessments on your critical assets identified by AIR automatically. This will deliver a new level of cyber resilience to your network or customer.

Try auto-asset tagging today with our free 14-day trial. Simply visit or click on this link.

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles