AUXO Curator

Before deploying the AUXO™ Curator E2 instance, ensure the following:

• An AWS account with permissions to deploy EC2 instances
• An Amazon S3 bucket where processed logs will be stored
• Access to the AUXO™ platform (AUXO™ is part of MDR Detect )

1. Log in to the AUXO™ platform and navigate to Curator Nodes.
2. Create a new Curator node.
3. Upon creation, a unique, single-use authentication token is generated. - This token is required to link the Curator E2 instance to the customers AUXO™ platform account.
   • If redeployment is required, a new token can be generated from the Curator node details page.
4. Deploy the Curator E2 instance
5. During deployment, add an EC2 instance tag:
   • Key auth_code
   • Value the authentication token provided by the AUXO™ platform
6. Once the Curator E2 instance successfully registers and appears in the AUXO™ platform, the auth_code tag can be removed.

The Curator E2 instance is stateless. If the instance is terminated or fails, a new instance can be launched using a newly generated token without any data loss.

SSH access is disabled by default on this instance for security purposes. Authentication between the instance and the AUXO™ platform is handled via a secure, one-time-use activation token provided as an instance tag (see configuration instructions above).

If SSH access is required for troubleshooting or maintenance, contact ON2IT support to enable it. Only key-based authentication is supported; password-based SSH login is not available. ON2IT support can generate and provision the required SSH key pair upon request.

• Logs are ingested, inspected, and processed in real time.
• No raw log data is stored on the Curator E2 instance.
• Processed and compressed logs are written to a customer-managed Amazon S3 bucket within the customers AWS account.
• Data ownership and retention policies remain entirely under customer control.

• Only security-relevant events derived from log analysis are forwarded to the AUXO™ platform for detection, correlation, and case creation.
• The region used for the AUXO™ platform is selected by the customer during onboarding.

• Data sent from the Curator E2 instance to the AUXO™ platform is encrypted in transit.
• Security events stored within the AUXO™ platform are encrypted at rest.
• Data sent from the Curator E2 instance to the customers Amazon S3 bucket is encrypted in transit.
• Encryption of inbound data sent to the Curator E2 instance depends on the selected ingestion protocol and customer configuration.

The health and status of the Curator E2 instance are continuously monitored within the AUXO™ platform.

• If any operational issues are detected, an alert is generated in the AUXO™ platform and the customer is notified via email.
• Customers can manually verify Curator health by checking the Curator node status in the AUXO™ platform.
• The EC2 instance status can also be reviewed directly in the AWS Management Console - instance serial console, where clear informational messages are provided if the instance fails to start or encounters issues.

Because the Curator E2 instance is stateless, recovery is achieved by simply launching a replacement instance, ensuring continuity without data loss.