Aurora EDR

Introduction

This room will introduce you to EDRs and Aurora, a Sigma-based tool for writing detection alerts via Windows Event logs.

Learning Objectives

The objectives of this room are:

• Introduce EDRs and their functionalities.
• Introduce Event Tracing for Windows.
• Learn about Aurora and its functionalities to write alerts using event logs. 
• Investigate suspicious events detected by Aurora.

Prerequisites

It is advisable to check out the following module and rooms before embarking on this room.

• Cyber Defense Module
• Windows Event Logs
• Sysmon
• Intro to Detection Engineering
  
• Sigma Room