Update Nextron Aurora lite EDR Agent

To manually update Nextrons Aurora Lite EDR agent, follow the steps: https://aurora-agent-manual.nextron-systems.com/en/latest/usage/upgrade-and-updates.html

1. Download Aurora Lite files & license: https://www.nextron-systems.com/aurora/
2. Unzip the files into a folder
3. Copy the license file into that folder
4. Start a PowerShell with Admin rights
5. Execute aurora-agent-util.exe upgrade --restart-service

Example

PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1>
PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1> aurora-agent-util.exe upgrade --restart-service
Aug 10 19:30:37 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: License file found OWNER: some@address.com VALID: true VALID_FROM: 2024/04/15 VALID_TO: 2025/02/21
Aug 10 19:30:37 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Checking for new version PRODUCT: aurora-agent-lite-win
Aug 10 19:31:08 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Stopped installed Aurora Agent service
Aug 10 19:31:08 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Installing downloaded package INSTALL_PATH: C:\Program Files\Aurora-Agent
Aug 10 19:31:13 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Started installed Aurora Agent service
Aug 10 19:31:13 clw11c493 AURORA: Info MODULE: Aurora-Agent MESSAGE: Updated Aurora Agent NEW: 1.2.1 OLD: 1.1.5
PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1>
PS C:\Users\clw11c493\Downloads\aurora-agent-lite-win-pack_v1.2.1>  

 

To debug aurora you can use aurora-agent-64.exe --debug

Nextron Aurora EDR agent shows \Pr Error

Problem

During start of Nextrons Aurora EDR lite agent the programm shows the following error message:

PS C:\Program Files\Aurora-Agent> aurora-agent-64.exe --dashboard
      ___                                  __    _ __
     /   | __  ___________  _________ _   / /   (_) /____
    / /| |/ / / / ___/ __ \/ ___/ __ `/  / /   / / __/ _ \
   / ___ / /_/ / /  / /_/ / /  / /_/ /  / /___/ / /_/  __/
  /_/  |_\__,_/_/   \____/_/   \__,_/  /_____/_/\__/\___/


  Aurora Agent Lite Version 1.2.1 (9da9fbf29275c), Signature Revision 2024/08/10-134221 (Sigma r2024-07-17-29-gace902b68)
  (C) Nextron Systems GmbH, 2022

Aug 10 19:51:16 clw11c493 AURORA: Error MODULE: EventDistributor MESSAGE: Could not parse process exclude ERROR: error parsing regexp: invalid character class range: `\Pr` LINE: error parsing regexp: invalid character class range: `\Pr`
Aug 10 19:51:16 clw11c493 AURORA: Error MODULE: EventDistributor MESSAGE: Could not parse process exclude ERROR: error parsing regexp: invalid character class range: `\Pr` LINE: error parsing regexp: invalid character class range: `\Pr`
Aug 10 19:51:16 clw11c493 AURORA: Error MODULE: EventDistributor MESSAGE: Could not parse process exclude ERROR: error parsing regexp: invalid character class range: `\Pr` LINE: error parsing regexp: invalid character class range: `\Pr`

Solution

Your "process-excludes.cfg" (C:\Program Files\Aurora-Agent\config\process-excludes.cfg) configurations probably has a missing escaping "\" in the process-path (aurora searches for those process paths using regular expression):

Wrong:

^"C:\Program Files (x86)\

Correct:

^"C:\\Program Files (x86)\\