Configure and maintain Aurora Lite¶

Choose an appropriate visibility profile, maintain signatures, and make controlled configuration changes without losing a known-good baseline.

Choose a configuration preset¶

Aurora includes Standard, Reduced, Minimal, and Intense presets. Begin with Standard unless the endpoint has a documented resource constraint or the test specifically requires an event source available only in Intense.

Preset	Use it when	Main trade-off
Minimal	Resource use must be tightly constrained	Several event sources and modules are disabled.
Reduced	A lightweight general-purpose baseline is required	Less telemetry than Standard.
Standard	Building a normal detection lab	Balanced visibility and resource use.
Intense	A controlled test requires maximum coverage	High event and resource volume, especially for registry activity.

The detailed preset table is preserved in the installation journey alongside the original service commands and resource warning.

Apply one change at a time¶

Record current service health and preset.
Take a VM snapshot or preserve the working configuration.
Change one setting, rule, IOC, or output option.
Restart or reload Aurora as required.
Repeat the positive test and a benign control.
Roll back if the baseline no longer passes.

Use custom-signatures for locally maintained Sigma rules and IOCs. Keep vendor signatures separate so updates do not overwrite local work.

Maintain signatures¶

After an update, record the update time, service restart, and one successful function test.

Avoid version-sensitive assumptions

Rule counts and exact titles can change with the open-source Sigma feed. Verify successful loading and record the rule identifier actually shown by your version.

Uninstall and rollback¶

Use Aurora's documented uninstall command from an elevated terminal. The complete guide also retains the service, directory, and scheduled-task cleanup commands for cases where normal removal fails.

Detailed configuration and removal walkthrough¶

The original custom-settings, signature-path, installation persistence, uninstall, service cleanup, directory removal, and scheduled-task procedures are preserved below.

Custom Settings¶

For instructions on adding your own Sigma rules or Indicators of Compromise (IOCs), refer to the Manual Signature Management section. The recommended approach is to place these custom rules in the custom-signatures folder before installing Aurora.

All flags used during installation (following --install) are saved in the configuration file named agent-config.yml, located in:

C:\Program Files\Aurora-Agent\

These settings are then applied by the Aurora service.

A typical installation command with custom settings might look like this:

aurora-agent.exe --install --activate-responses

Manual Signature Management¶

Aurora uses rules based on the open Sigma specification and rule ecosystem. Signatures can be defined when starting Aurora by using the --rules-path and --ioc-path parameters. By default, these parameters point to:

Built-in rules and IOCs: signatures\sigma-rules and signatures\iocs
Custom rules and IOCs: custom-signatures\sigma-rules and custom-signatures\iocs

Aurora will recursively traverse the specified directories and load all signature files it finds.

To add new Sigma rules or IOCs, you can either:

Place them in the appropriate subfolder within custom-signatures.
Specify their location directly using the -rules-path or -ioc-path parameters.

Warning: When using --rules-path or --ioc-path, if you wish to include Aurora’s built-in rules and IOCs, you must explicitly add their paths as well. For example:

aurora-agent.exe --install --rules-path .\signatures\sigma-rules --rules-path .\my-rules

If custom paths are configured, only the specified paths will be used.

Uninstalling Aurora¶

To uninstall the Aurora agent, simply execute the following command in an administrative terminal:

aurora-agent.exe --uninstall

If the uninstaller encounters errors and fails, you can manually remove Aurora using these commands:

Stop the Aurora service:
```
sc stop aurora-agent
```
Delete the service:
```
sc delete aurora-agent
```

Remove the program files:

rmdir /s /q "C:\Program Files\Aurora-Agent"

Delete scheduled tasks:

schtasks /Delete /F /TN aurora-agent-program-update
schtasks /Delete /F /TN aurora-agent-signature-update

Checkpoint

The chosen preset is documented, the service restarts cleanly, rules load successfully, and a known test still produces the expected result.