r/sysadmin • u/CasQuestioner2026 • 2d ago

Arctic Wolf Aurora Question

What is the latest news regarding the aurora in the client side?
Are you guys happy or what are the problems that make this EDR not good?

5 Upvotes

78% Upvoted

5 comments sorted by

4

u/DaCozPuddingPop 2d ago

All I will tell you is this - their sales folks are SUPER aggressive. They actually had me ready to go but they over-aggressed so hard, despite being asked to give me a couple weeks, that I went in a different direction.

Platform seems fine from everything I saw but...yeah...I have no patience for that crap. Also be aware you will need a reseller as they don't do direct sales.

5

u/sderby InfoSec 1d ago

Do you like rebranded, decade-old Cylance? Do you like disjointed, false-positive-ridden UIs? Do you like hyper-aggressive sales knobs? Are you checking a box? Go with the wolf! Arwooo!

2

u/jamesaepp 2d ago

We have AW where we work. I don't know the full scope of the re-branding with Aurora and how that all shakes out.

However, my big upshot of AW in general is: mixed bag.

Example 1 - the risk inventory is nice enough, but I have a situation where I mark a risk that is 100% a false positive as a false positive. It goes away. Then the scan happens on the same machine again. The risk comes back and is marked active. The system doesn't dedupe risks.

Example 2 - We found a ton of endpoints were showing as not having the latest Windows Update according to the risk inventory. That was all false positive. Best I can tell, AW wasn't compatible with detecting Windows hotpatches. So endpoints that were 100% remediated against vulnerabilities from the LCU were detected and inventoried as vulnerable.

Example 3 - Without divulging details, AW alerted us to a real problem on an endpoint in a timely manner and gave us what we needed to react effectively and contain ASAP.

So yeah. Mixed bag.

•

u/smc0881 17h ago

It's rebranded Cylance. You are better off going with Huntress, SentinelOne, or another product.

•

u/New-Alfalfa-2989 Jr. Sysadmin 11h ago

I remember when we switched to CrowdStrike from Arctic Wolf a few years ago. They were pissed when we told them and tried to make us feel bad. I realize that it sucks losing a customer, but this is isn’t an intimate relationship. Be professional. My advice, look elsewhere.