Aurora Agent User Manual

Contents:

• 1. What is Aurora?
• 2. What is Aurora Lite?
• 3. Installation
  • 3.1. Requirements
  • 3.2. Quick Installation
  • 3.3. Manual installation
  • 3.4. Installation using ASGARD
• 4. Aurora Agent Dashboard
  • 4.1. Dashboard Activation
  • 4.2. Dashboard UI Access
  • 4.3. Notifications
  • 4.4. Settings
• 5. Usage
  • 5.1. Run Aurora
  • 5.2. Run Aurora as Service
  • 5.3. Aurora Service Status Information
  • 5.4. Tracing Events
• 6. Configuration
  • 6.1. Configuration Presets
  • 6.2. Output Options
  • 6.3. Process Exclusions
  • 6.4. False Positive Filtering
• 7. Upgrading and Updating Aurora
  • 7.1. Management Aurora using ASGARD
  • 7.2. Automatic Updates via Scheduled Tasks
  • 7.3. Manual Upgrades and Updates
  • 7.4. Update Servers
• 8. Responses
  • 8.1. Types of Actions
  • 8.2. Response flags
  • 8.3. Response Examples
  • 8.4. Specifying a Response for a Sigma rule
  • 8.5. Action Results
• 9. Modules
  • 9.1. Providers
  • 9.2. Consumers
• 10. Function Tests
  • 10.1. Sigma Matching
  • 10.2. IOC Matching
  • 10.3. CommandLineMismatchDetector
• 11. Custom Signatures and IOCs
  • 11.1. Management using ASGARD
  • 11.2. Manual signature management
  • 11.3. Signature Application
• 12. Aurora Agent Util
  • 12.1. Updating Aurora
  • 12.2. Encrypting Signatures
  • 12.3. Excluding Processes
  • 12.4. Creating a Diagnostics Pack
• 13. List of Event IDs
  • 13.1. Sigma related event IDs
  • 13.2. Internal event IDs
  • 13.3. Event IDs for other modules
• 14. Debugging
  • 14.1. Status Information
  • 14.2. Diagnostic information
  • 14.3. Crashes
  • 14.4. Error Messages
  • 14.5. Performance Tuning
• 15. Known Issues
  • 15.1. AUR#002: Missing exclude Feature in Aurora Util Lite
  • 15.2. AUR#001: Missing Self-Defense
• 16. Detection Gaps
  • 16.1. Named Pipes
  • 16.2. Registry Events
  • 16.3. ETW disabling
  • 16.4. Handle polling and asynchronous handles
• 17. Frequently Asked Questions
  • 17.1. Why does Aurora use a lot of memory?
  • 17.2. What's the impact of Sigma rule matching on the agent's performance?
  • 17.3. Why does Aurora Lite use the newest rules while Aurora doesn't?
  • 17.4. Why does Aurora generate two alerts for a single event?
  • 17.5. How do I view the suppressed Sigma matches?
  • 17.6. Why does the Event ID in the Windows Eventlog differ from the one in the Event Data?
  • 17.7. Why does Aurora take so long to start?
  • 17.8. Why doesn't Aurora report Registry matches?
• 18. Changelog
  • 18.1. Aurora Agent 1.2
  • 18.2. Aurora Agent 1.1
  • 18.3. Aurora Agent 1.0
  • 18.4. Aurora Agent 0.9
  • 18.5. Aurora Agent 0.8
  • 18.6. Aurora Agent 0.7
  • 18.7. Aurora Agent 0.6
  • 18.8. Aurora Agent 0.5
  • 18.9. Aurora Agent 0.4
  • 18.10. Aurora Agent 0.3
  • 18.11. Aurora Agent 0.2
  • 18.12. Aurora Agent 0.1

Indices and tables

• Search Page