acquire_baseline

Assign a baseline acquisition task to specific endpoints using filters like asset name, IP address, or platform, associated with a case ID for forensics and incident response in Binalyze AIR.

Instructions

Assign a baseline acquisition task to specific endpoints

Input Schema

Name	Required	Description	Default
`caseId`	Yes	The case ID to associate the baseline acquisition with
`filter`	Yes	Filter object to specify which assets to acquire baseline from

Input Schema (JSON Schema)

{
  "properties": {
    "caseId": {
      "description": "The case ID to associate the baseline acquisition with",
      "type": "string"
    },
    "filter": {
      "description": "Filter object to specify which assets to acquire baseline from",
      "properties": {
        "excludedEndpointIds": {
          "description": "Array of endpoint IDs to exclude",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "groupFullPath": {
          "description": "Filter by full group path",
          "type": "string"
        },
        "groupId": {
          "description": "Filter by group ID",
          "type": "string"
        },
        "includedEndpointIds": {
          "description": "Array of endpoint IDs to include for baseline acquisition",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "ipAddress": {
          "description": "Filter by IP address",
          "type": "string"
        },
        "isolationStatus": {
          "description": "Filter by isolation status (e.g., [\"isolated\"])",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "issue": {
          "description": "Filter by issue",
          "type": "string"
        },
        "managedStatus": {
          "description": "Filter by managed status (e.g., [\"managed\"])",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "name": {
          "description": "Filter by asset name",
          "type": "string"
        },
        "onlineStatus": {
          "description": "Filter by online status (e.g., [\"online\"])",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "organizationIds": {
          "description": "Organization IDs filter. Defaults to [0]",
          "items": {
            "type": "number"
          },
          "type": "array"
        },
        "platform": {
          "description": "Filter by platform (e.g., [\"windows\"])",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "policy": {
          "description": "Filter by policy",
          "type": "string"
        },
        "searchTerm": {
          "description": "Optional search term",
          "type": "string"
        },
        "tags": {
          "description": "Filter by tags",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "version": {
          "description": "Filter by agent version",
          "type": "string"
        }
      },
      "type": "object"
    }
  },
  "required": [
    "caseId",
    "filter"
  ],
  "type": "object"
}

This server cannot be installed

Other Tools from Binalyze AIR MCP Server

Related Tools

add_tags_to_assets
@binalyze/air-mcp
purge_and_uninstall_assets
@binalyze/air-mcp
get_case_endpoints
@binalyze/air-mcp
remove_endpoints_from_case
@binalyze/air-mcp
get_task_by_id
@binalyze/air-mcp
list_acquisition_profiles
@binalyze/air-mcp