--- title: "BitLyft AIR® v1.26: Smarter Case Context, CrowdStrike Response, and Automatic IP Enrichment" description: BitLyft AIR® v1.26 enhances security operations with smarter case context, native CrowdStrike integration, and automatic IP enrichment for fast response. image: https://www.bitlyft.com/hubfs/v1.26.png --- [Skip to content](https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment#main-content) [![BitLyft Cybersecurity](https://www.bitlyft.com/hubfs/BitLyft-header-logo.svg)](https://www.bitlyft.com/) - Solutions Show submenu for Solutions - [BitLyft True MDR](https://www.bitlyft.com/agentic-mdr) Show submenu for BitLyft True MDR - [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) - [Security Automation](https://www.bitlyft.com/security-automation) - [Security Operation Center (SOC)](https://www.bitlyft.com/security-operations-center-soc) - [SIEM Management](https://www.bitlyft.com/security-information-and-event-management-siem) - [Central Threat Intelligence](https://www.bitlyft.com/central-threat-intelligence) - [BitLyft AIR®](https://www.bitlyft.com/air) - Industries Show submenu for Industries - [Banking](https://www.bitlyft.com/cybersecurity-for-banks) - [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) - [DoD (CMMC)](https://www.bitlyft.com/cmmc-cybersecurity-compliance) - [NIST 800 - 171](https://www.bitlyft.com/nist-800-171) - [Healthcare](https://www.bitlyft.com/healthcare-cybersecurity) - [Higher Education](https://www.bitlyft.com/higher-education-cybersecurity) - [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) - [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) - [Energy and Utilities](https://www.bitlyft.com/energy-utilities-cybersecurity) - [Pricing](https://www.bitlyft.com/agentic-managed-detection-response-pricing) - [Partners](https://www.bitlyft.com/partners) - Company Show submenu for Company - [About Us](https://www.bitlyft.com/about-us) - [Careers](https://www.bitlyft.com/careers) - [Contact Us](https://www.bitlyft.com/contact-us) - Resources Show submenu for Resources - [Blog](https://www.bitlyft.com/resources) - [Case Studies](https://www.bitlyft.com/case-studies) - [Downloads](https://www.bitlyft.com/downloads) - [Glossary](https://www.bitlyft.com/glossary-of-terms) - [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) Open main navigation Close main navigation - Solutions Show submenu for Solutions - [BitLyft True MDR](https://www.bitlyft.com/agentic-mdr) Show submenu for BitLyft True MDR - [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) - [Security Automation](https://www.bitlyft.com/security-automation) - [Security Operation Center (SOC)](https://www.bitlyft.com/security-operations-center-soc) - [SIEM Management](https://www.bitlyft.com/security-information-and-event-management-siem) - [Central Threat Intelligence](https://www.bitlyft.com/central-threat-intelligence) - [BitLyft AIR®](https://www.bitlyft.com/air) - Industries Show submenu for Industries - [Banking](https://www.bitlyft.com/cybersecurity-for-banks) - [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) - [DoD (CMMC)](https://www.bitlyft.com/cmmc-cybersecurity-compliance) - [NIST 800 - 171](https://www.bitlyft.com/nist-800-171) - [Healthcare](https://www.bitlyft.com/healthcare-cybersecurity) - [Higher Education](https://www.bitlyft.com/higher-education-cybersecurity) - [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) - [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) - [Energy and Utilities](https://www.bitlyft.com/energy-utilities-cybersecurity) - [Pricing](https://www.bitlyft.com/agentic-managed-detection-response-pricing) - [Partners](https://www.bitlyft.com/partners) - Company Show submenu for Company - [About Us](https://www.bitlyft.com/about-us) - [Careers](https://www.bitlyft.com/careers) - [Contact Us](https://www.bitlyft.com/contact-us) - Resources Show submenu for Resources - [Blog](https://www.bitlyft.com/resources) - [Case Studies](https://www.bitlyft.com/case-studies) - [Downloads](https://www.bitlyft.com/downloads) - [Glossary](https://www.bitlyft.com/glossary-of-terms) - [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) - [Request a Demo](https://www.bitlyft.com/request-a-demo) [Request a Demo](https://www.bitlyft.com/request-a-demo) [All posts](https://www.bitlyft.com/resources/all) May 20, 2026 # BitLyft AIR® v1.26: Smarter Case Context, CrowdStrike Response, and Automatic IP Enrichment ![air-v.1.26](https://www.bitlyft.com/hubfs/v1.26.png) ![Picture of BitLyft Team](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) By  BitLyft Team  ·  2 minute read Security teams need better context, faster answers, and the ability to act without bouncing between tools. Every second spent figuring out *why* a case was triggered, or pivoting out to look up an IP, is a second longer attackers have to operate. With **BitLyft AIR® v1.26**, we're sharpening the platform across three areas that matter most to analysts: **clearer case notifications**, a **native CrowdStrike integration** for endpoint detection and response, and **automatic case enrichment** with IP reputation and geolocation data. The result is faster triage, stronger endpoint coverage, and less manual work on every investigation. ### **Cleaner Case Notifications, More Useful Context** Case email notifications have been redesigned to give teams the context they need *before* they log into AIR®. Instead of a basic "a case was created" message, notifications now include clear details on **why the case was triggered** and what's behind it. Analysts, IT staff, and stakeholders can quickly determine whether a case needs immediate attention or can wait for normal review. Key benefits: - Cleaner, easier-to-read case notifications - More context around why a case was created - Faster triage before logging into AIR® - Improved visibility for analysts and stakeholders ### **Native CrowdStrike Integration** BitLyft AIR® v1.26 introduces a **native CrowdStrike integration**, expanding AIR®'s endpoint visibility and automated response capabilities. AIR® can now collect CrowdStrike logs, evaluate that activity against new built-in policies, and execute response actions directly through AIR® playbooks — whether automated or analyst-driven. This release includes: - CrowdStrike log collection - Two new CrowdStrike detection policies - 29 new CrowdStrike response actions #### **New CrowdStrike Detections** **Malware Persistence on Host** — Detects repeated observations of malicious files or processes on a single endpoint, surfacing signs of unauthorized access, incomplete remediation, or attackers maintaining a foothold. *(MITRE: Persistence — TA0003)* **Malware Spread** — Identifies malicious files or processes appearing across multiple hosts within a short timeframe, helping teams catch lateral movement and contain outbreaks before they widen. *(MITRE: Lateral Movement — TA0008)* #### **Automated Response Across Endpoints, Users, and IOCs** With 29 new response actions, AIR® can now drive CrowdStrike directly from a case. IT and operations workflows are covered too — user lifecycle management, watchlist cleanup, RTR session management, and stopping in-flight searches, all triggerable from AIR®.   ### **Automatic Case Enrichment with AbuseIPDB and IpGeolocation.io** Every case in BitLyft AIR® is now **automatically enriched** when IP-related observables are present, thanks to new integrations with **AbuseIPDB** and **IpGeolocation.io**. That means analysts no longer have to break their flow to look up an IP address. Reputation scores, abuse reports, and geolocation details appear directly inside the case — ready to inform triage and prioritization. Key benefits: - Automatic IP reputation and geolocation enrichment - More context available - Reduced manual investigation time - Better support for validating suspicious activity - Faster prioritization of potentially malicious IP activity ### **A Stronger Platform for Detection, Response, and Investigation** With v1.26, BitLyft AIR® continues to expand the value security teams get from a single, automated platform: - Clearer context the moment a case is created - Native CrowdStrike detection and automated response - Built-in IP enrichment on every relevant case - Broader endpoint, identity, and IOC coverage **BitLyft AIR® v1.26 helps security teams move faster, investigate smarter, and respond with confidence, without leaving the platform.** ### **Learn More** To see how BitLyft AIR® automates detection, enrichment, and response across endpoints, identity providers, and cloud platforms, book a 15-minute demo. [Book a Demo](https://www.bitlyftair.ai/contact)   Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment) [twitter icon](https://twitter.com/intent/tweet?url=https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment) [envelope icon](mailto:?body=https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment) [![Group 1000001766](https://www.bitlyft.com/hubfs/Group%201000001766.svg "Group 1000001766")](https://www.bitlyft.com) [BitLyft AIR®](https://www.bitlyft.com/air) [Agentic MDR](https://www.bitlyft.com/agentic-mdr) [Partner](https://www.bitlyft.com/partners) [Privacy Policy](https://www.bitlyft.com/privacy-policy) [Careers](https://www.bitlyft.com/careers) [Blog](https://www.bitlyft.com/resources) [White Papers](https://www.bitlyft.com/downloads) [Use Cases](https://www.bitlyft.com/case-studies) [Miller Mindset Podcast](https://www.youtube.com/playlist?list=PLz7CtIA5QhhJgjIo3CUpdm7gm3Th6mrcm) [About Us](https://www.bitlyft.com/about-us) [Contact Us](https://www.bitlyft.com/contact-us) [News](https://www.bitlyft.com/news) [Get A Quote](https://www.bitlyft.com/get-a-quote) [facebook-f icon](https://www.facebook.com/BitLyft) [linkedin-in icon](https://www.linkedin.com/company/bitlyft/) [twitter icon](https://twitter.com/bitlyft) [youtube icon](https://www.youtube.com/channel/UCGMnF3PMXFgTotrnPJfC87w) Copyright © 2026, BitLyft Cybersecurity [![BitLyft Cybersecurity](https://www.bitlyft.com/hubfs/BitLyft-header-logo.svg)](https://www.bitlyft.com) Solutions [FeaturedBitLyft AIR® Autonomous SOC — detection, response & remediation on autopilot, around the clock. Explore the platform](https://www.bitlyft.com/air) Our Solutions [BitLyft Agentic MDRFully managed detection & response](https://www.bitlyft.com/agentic-mdr) [Security AutomationAutomate the busywork of defense](https://www.bitlyft.com/security-automation) [Security Operations Center24/7 SOC coverage](https://www.bitlyft.com/security-operations-center-soc) [SIEM ManagementTuned, managed & monitored](https://www.bitlyft.com/security-information-and-event-management-siem) [Central Threat IntelligenceShared signal across customers](https://www.bitlyft.com/central-threat-intelligence) [BitLyft AIR®Automated incident response](https://www.bitlyft.com/air) [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) [Plans & pricing](https://www.bitlyft.com/pricing) [Compare MDR vs. AIR NEW](https://www.bitlyft.com/true-mdr) Industries [Compliance-readyDoD & CMMC Meet CMMC and NIST 800-171 with security operations built for regulated sectors. See compliance coverage](https://www.bitlyft.com/cmmc) Industries we protect [Banking](https://www.bitlyft.com/banking) [FinTech](https://www.bitlyft.com/managed-detection-and-response-for-fintech) [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) [DoD (CMMC)](https://www.bitlyft.com/cmmc) [NIST 800-171](https://www.bitlyft.com/nist-800-171) [Healthcare](https://www.bitlyft.com/managed-detection-and-response-for-healthcare) [Higher Education](https://www.bitlyft.com/higher-education) [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) [Energy & Utilities](https://www.bitlyft.com/energy-and-utilities) [Manufacturing](https://www.bitlyft.com/agentic-mdr-for-manufacturing) [Pricing](https://www.bitlyft.com/pricing) [Partners](https://www.bitlyft.com/partners) Company [Who we areAbout BitLyft On a mission to make elite cybersecurity accessible to every organization. Our story](https://www.bitlyft.com/about-us) Company [About Us](https://www.bitlyft.com/about-us) [Careers](https://www.bitlyft.com/careers) [Contact Us](https://www.bitlyft.com/contact-us) Resources [LearnBitLyft Blog Threat research, how-to guides and security insights from our SOC team. Read the blog](https://www.bitlyft.com/resources) Resources [Blog](https://www.bitlyft.com/resources) [Newsroom](https://www.bitlyft.com/news) [Case Studies](https://www.bitlyft.com/case-studies) [Downloads](https://www.bitlyft.com/downloads) [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) [Request a Demo](https://www.bitlyft.com/request-a-demo) [Request a Demo](https://www.bitlyft.com/request-a-demo) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "BitLyft Team", "url" : "https://www.bitlyft.com/resources/author/bitlyft-team" }, "dateModified" : "2026-05-20T13:00:04.945Z", "datePublished" : "2026-05-20T13:00:04.000Z", "headline" : "BitLyft AIR® v1.26: Smarter Case Context, CrowdStrike Response, and Automatic IP Enrichment", "image" : [ "https://www.bitlyft.com/hubfs/v1.26.png" ], "mainEntityOfPage" : { "@id" : "https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.bitlyft.com/hubfs/BitLyft%20Logo%20(New)/BLLogo.svg" }, "name" : "BitLyft" } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "BitLyft Team" ] }, "datePublished" : "2026-05-20T13:00:04+0000", "description" : "BitLyft AIR® v1.26 enhances security operations with smarter case context, native CrowdStrike integration, and automatic IP enrichment for fast response.", "headline" : "BitLyft AIR® v1.26: Smarter Case Context, CrowdStrike Response, and Automatic IP Enrichment", "image" : "https://6764014.fs1.hubspotusercontent-na1.net/hubfs/6764014/v1.26.png", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.bitlyft.com/hubfs/BitLyft%20Logo%20(New)/BLLogo.svg" }, "name" : "BitLyft Cybersecurity" }, "url" : "https://www.bitlyft.com/resources/bitlyft-air-v1.26-smarter-case-context-crowdstrike-response-and-automatic-ip-enrichment" } ```