Upgrade to Aurora Protect 3.x

This section provides step-by-step guidance and best practices to ensure a successful upgrade to Aurora Protect version 3.x.

After completing all testing and validation in your test environment, apply the upgrade and updated device policies to your production environment.

Prepare your test environment

  1. Test the upgrade to Aurora Protect agent version 3.x for Windows in a dedicated testing zone before deploying the upgrade to your production environment.

    For more information about zones, see Add and configure a zone.

  2. Set up your test devices with apps and configurations that accurately represent your production environment.
  3. Create dedicated device policies for your testing zones and devices.

    You can create new device policies or copy and modify existing policies.

  4. Configure zone-based update rules in the Aurora Endpoint Security console to restrict the 3.x upgrade to the dedicated testing zones and devices.

    For instructions, see Manage updates for the Aurora Protect Desktop and Aurora Focus agents.

  5. Optional: Download the Support Collection Tool from KB 42221100953755.

    If you contact Arctic Wolf Support for assistance, Support may ask you to run the tool to collect additional data.

  6. Review Aurora Protect agent version 3.x upgrade paths to identify the relevant path.

Configure and test memory protection

Aurora Protect Desktop 3.x introduces various memory protection enhancements and increased visibility into the activity of the applications and processes on a device. In some situations, applications perform operations that could be considered malicious, but are performed for legitimate purposes. Arctic Wolf recommends following the steps and best practices below to ensure the proper tuning of the Aurora Protect Desktop 3.x agent before you deploy it to your production environment. For more information about memory protection violation types, see Device policy: Memory Protection settings in the Aurora Endpoint Security setup content.
  1. In the management console, on the menu bar, click Policies > Device Policy.
  2. Click the device policy for your test devices.
  3. On the Memory Actions tab, select the Memory Protection check box.
  4. In the Violation Type table, expand Exploitation, Process Injection, and Escalation. For all violation types listed under Available for Agent Version 2.1.1580 and higher and Available for CylancePROTECT 3.0 and higher, select the ALERT action.
  5. Save the device policy.
  6. Run Aurora Protect Desktop 3.x on your test devices and review alerts to determine the risk of these exploits within your environment. If any of these alerts are low risk and will cause business impact, you can add targeted memory protection exclusions. For instructions and guidance, see Memory Protection.
    It is recommended that you restart each test device after you install or upgrade to Aurora Protect Desktop 3.x.
After you review alerts and add the necessary exclusions, you can change the violation type actions in the device policy as necessary (for example, Block or Terminate).

Configure and test macro detection (Windows only)

There are two options available in a device policy to detect and respond to potentially dangerous macros on Windows devices. The Macros option on the Script Control tab applies to Windows agent 2.1.1578 and earlier. The new Exploitation > Dangerous VBA Macro option on the Memory Actions tab applies to Windows agent 2.1.1580 and later. When you test your upgrade to agent 3.x, you must check your current configuration for detecting and responding to macros and configure the new Dangerous VBA Macro option accordingly.
  1. In the management console, on the menu bar, click Policies > Device Policy.
  2. Click your production device policy.
  3. On the Script Control tab, note the current configuration for macros (Alert or Block).
  4. In Policies > Device Policy, click the device policy for your test devices.
  5. On the Memory Actions tab, expand Exploitation.
  6. For the Dangerous VBA Macro violation type, set the appropriate action (Ignore, Alert, Block, or Terminate).
  7. Save the device policy.
  8. If necessary, migrate script control macro exclusions to the new memory protection configuration.
  9. Run Aurora Protect Desktop 3.x on test devices that use files with macros that are commonly used in your organization. If necessary, add additional memory protection exclusions for safe macros. For instructions and guidance, see Device policy: Memory Protection settings in the Aurora Endpoint Security setup content.

Migrate script control macro exclusions to the new memory protection configuration (Windows only)

If you previously added macro exclusions on the Script Control tab of your device policies, you must migrate those exclusions to the new memory protection configuration for Aurora Protect Desktop for Windows 3.x. If you want to migrate the script control exclusions manually, you can simply record the exclusions you added on the Script Control tab of your device policies, then add the same exclusions on the Memory Actions tab in your device policies.

Follow the steps below if you want to migrate the existing script control exclusions using a PowerShell script that Arctic Wolf provides.

Note: The steps below apply to tenants managed using the Endpoint Defense console. If you manage tenants using the Multi-Tenant Console, see KB 42221231386907.
  • Verify that PowerShell is installed on your computer and that PowerShell scripts are not blocked by security software, including Aurora Protect Desktop. If Aurora Protect Desktop is installed on your computer, in the device policy assigned to your device, verify that Script Control > Block PowerShell console usage is turned off.
  • In the Endpoint Defense console, add an integration with the following API privileges and record the resulting application ID and secret:
    • Policies: Read, Modify
    • Users: Read
  • In Settings > Integrations, record the Tenant ID.
  • When you run the script, you will specify the email address of an Endpoint Defense console administrator account. Verify that the account that you want to use has the Administrator role.
  • In the device policies where you want to migrate exclusions from script control to memory protection, verify that script control is enabled and that macro exclusions are present.
    • The script will ignore policies with script control disabled and policies that do not have any script control exclusions.
    • The script does not migrate exclusion lists with multibyte characters. You must add these exclusions manually.
  • Download the PowerShell script.
  1. Open a PowerShell command prompt and change the directory to the location of the script.
  2. Run the script using the appropriate parameters from the table below.
    • Run the script in -dryRun mode first to preview the migration without making any changes. This will produce an output file that you can use to identify and correct any issues.
    • Run the script for the specific device policies that you plan to use for testing. After your testing and validation of the 3.x agent, you can use the script to apply the migration to your production device policies.

    Parameter

    Required or optional

    Description

    -copySCExclusions

    Required

    This command executes the migration of macro exclusions from the script control configuration to the new memory protection configuration.

    -allPolicies

    OR

    -policy ‘policy_name’

    Required

    -allPolicies executes the migration for all device policies in your tenant.

    -policy ‘policy_name>’' executes the migration for a specified device policy.

    -dryRun

    Optional

    This command previews the execution of the script without making any changes. When you run the script in this mode, it creates an output file in the directory that the script is executed from.

    -tenantId ‘tenant_ID’

    Required

    This command specifies the ID of your Aurora Endpoint Security tenant.

    -apiKey ‘application_ID’

    Required

    This command specifies the application ID of the integration that you added in Settings > Integrations.

    -apiSecret ‘application_secret’

    Required

    This command specifies the application secret of the integration that you added in Settings > Integrations.

    -userEmail ‘admin_email’

    Required

    This command specifies the email address of the Endpoint Defense console administrator account that you want to use to execute the migration. The account must have the Administrator role.

    -region ‘region_code’

    Required
    This command specifies the region of your Aurora Endpoint Security tenant. Use one of the following values:
    • North America: na (default value if not specified)
    • Japan: apne1
    • Australia: au
    • Europe: euc1
    • South America: sae1
    • GovCloud: us

    -Ignore158xWarning

    Optional

    This command makes the migration process ignore errors related to the size limit for memory protection exclusions, which has been increased from 64 KB for older versions of Aurora Protect Desktop to 2 MB for version 3.x.

    Note: Use this parameter only if all devices that are associated with the target device policy use agent 3.x or later.

    -ignore158xCompatibility

    Optional

    This command is related to a specific defect with Aurora Protect Desktop for Windows 2.1.1580 and 1584 (see KB 42221299286939). The fix for the defect (adding an additional asterisk(*) to the wildcard value in an exclusion path to make the wildcard **) is built into the script by default. If you use this parameter, the fix that is built into the script is disabled.

    Note: Use this parameter if the target device policy is associated with devices with agent 1578 or earlier and devices with agent 3.x or later. If the policy is associated with any devices with agent 158x, do not use this parameter.

    -includeExtensions extensions

    Optional

    This command specifies the extensions to migrate to the memory protection configuration (for example, -includeExtensions ps1, ja, xlxs).

    If you don’t use this parameter, all extensions are migrated.
Note: When you run the script in -dryRun mode, you may encounter the following error in the output file: “Entering Modify 'policy_name' Policy... logError : The requested policy has not been converted to MemoryProtection v2.” This can occur if a device policy has not been edited for some time. To resolve this issue, in the management console, open and save the policy.

The PowerShell output will indicate if any script control exclusions could not be migrated. You must add these exclusions to the memory protection configuration manually.

Example: Run the script in -dryRun mode

CODE 
.\sc2memdef_copy.ps1 -copySCExclusions -allPolicies -dryRun -tenantId '00000000-0000-0000-0000-000000000000' -apiKey '00000000-0000-0000-0000-000000000000' -apiSecret '00000000-0000-0000-0000-000000000000' -userEmail 'user@blackberry.com' -region 'na'

Example: Run the script for a specific device policy

CODE 
.\sc2memdef_copy.ps1 -copySCExclusions -policy 'userPolicy' -tenantId '00000000-0000-0000-0000-000000000000' -apiKey '00000000-0000-0000-0000-000000000000' -apiSecret '00000000-0000-0000-0000-000000000000' -userEmail 'user@blackberry.com' -region 'na'

Example: Run the script for all device policies

CODE 
.\sc2memdef_copy.ps1 -copySCExclusions -allPolicies -tenantId '00000000-0000-0000-0000-000000000000' -apiKey '00000000-0000-0000-0000-000000000000' -apiSecret '00000000-0000-0000-0000-000000000000' -userEmail 'user@blackberry.com' -region 'na'
  • On the Memory Actions tab of the target device policies, check the migrated exclusions and delete any that do not apply to the new Dangerous VBA Macro violation type.
  • Delete the PowerShell integration that you added to the management console.