attack_range icon indicating copy to clipboard operation
attack_range copied to clipboard

Published 20 hours ago • verified publisher icon splunk

Add TA-aurora to AR

Open ccl0utier opened this issue 3 years ago • 0 comments

We should look into deploying TA-aurora as part of Attack Range when the Aurora EDR agent is configured (install_aurora_agent = 1).

Deploying it after the fact manually is not as practical given that the TA has index-time extractions.

We should use the updated TA here (version 0.2.0 - which should be available very shortly) and ensure to rename any inputs for it to use the updated sourcetype nextron:aurora:edr.

ccl0utier avatar Sep 08 '22 18:09 ccl0utier