Configure and maintain Aurora Lite¶
Choose an appropriate visibility profile, maintain signatures, and make controlled configuration changes without losing a known-good baseline.
Choose a configuration preset¶
Aurora includes Standard, Reduced, Minimal, and Intense presets. Begin with Standard unless the endpoint has a documented resource constraint or the test specifically requires an event source available only in Intense.
| Preset | Use it when | Main trade-off |
|---|---|---|
| Minimal | Resource use must be tightly constrained | Several event sources and modules are disabled. |
| Reduced | A lightweight general-purpose baseline is required | Less telemetry than Standard. |
| Standard | Building a normal detection lab | Balanced visibility and resource use. |
| Intense | A controlled test requires maximum coverage | High event and resource volume, especially for registry activity. |
The complete preset table retains every original setting and warning.
Apply one change at a time¶
- Record current service health and preset.
- Take a VM snapshot or preserve the working configuration.
- Change one setting, rule, IOC, or output option.
- Restart or reload Aurora as required.
- Repeat the positive test and a benign control.
- Roll back if the baseline no longer passes.
Use custom-signatures for locally maintained Sigma rules and IOCs. Keep vendor signatures separate so updates do not overwrite local work.
Maintain signatures¶
The original guide retains the complete manual signature management, update-server, and custom-settings procedures. After an update, record the update time, service restart, and one successful function test.
Avoid version-sensitive assumptions
Rule counts and exact titles can change with the open-source Sigma feed. Verify successful loading and record the rule identifier actually shown by your version.
Uninstall and rollback¶
Use Aurora's documented uninstall command from an elevated terminal. The complete guide also retains the service, directory, and scheduled-task cleanup commands for cases where normal removal fails.
Open the original uninstall procedure.
Checkpoint
The chosen preset is documented, the service restarts cleanly, rules load successfully, and a known test still produces the expected result.