Ctrlk
TD Website
For the complete documentation index, see llms.txt. This page is also available as Markdown.

ESET EDR

The ThreatDefence platform supports integration with ESET PROTECT and ESET Inspect Cloud to ingest endpoint detection and response telemetry. Logs collected from ESET provide visibility into malware detections, suspicious activities, and endpoint risk events.

The platform supports integration using a syslog interface or with ESET Connect, an API gateway between a client and a collection of ESET backend services of the following modules: ESET PROTECT (Cloud), ESET Inspect, and ESET Cloud Office Security.

Syslog Setup

Prerequisites

  • ESET PROTECT (cloud): access to the ESET PROTECT Hub with Superuser permissions.

  • ESET PROTECT On-Prem: administrator access to the ESET PROTECT On-Prem web console.

  • A ThreatDefence syslog appliance or VM.

Steps

Step 1. Syslog Configuration

ThreatDefence ingests ESET events as a JSON payload inside a Syslog (RFC 5424) envelope. Whichever ESET console you use, set these two options:

Setting
Value

Format of payload (On-Prem: Format)

JSON

Format of envelope of the log (On-Prem: Version)

Syslog (RFC 5424)

Important: Do not select CEF, LEEF or the BSD envelope. Events sent in those formats are not ingested.

ESET PROTECT (cloud)

  1. Go to Integrations > Marketplace, find Syslog Forwarder and click Connect.

  2. In General settings, set:

    • Name: for example, ThreatDefence.

    • Format of payload: JSON.

    • Format of envelope of the log: Syslog.

    • Minimal log level: Information, so that audit events are sent as well as detections.

    • Destination IP or FQDN of TLS-compatible syslog server: the public IP address or hostname of your ThreatDefence syslog appliance.

    • Port: the port allocated for this log source (see the Syslog Onboarding Guide).

    • Octet-counted framing: leave at the default (enabled).

  3. Click Continue. In Log Settings and Certificate, select the Event types to log (Antivirus, HIPS, Firewall, Web protection, Audit Log, Blocked files, ESET Inspect alerts, Incidents). Turn on Validate CA Root certificates of TLS connections only if ThreatDefence support has given you a certificate chain to paste.

  4. Click Continue, review the Summary, click Test Log, then click Finish. The configuration takes effect within 10 minutes.

Note: ESET PROTECT (cloud) only sends syslog over TLS to a publicly reachable address. If your ThreatDefence syslog appliance is not reachable from the internet over TLS, contact ThreatDefence support before you configure this.

ESET PROTECT On-Prem 13.1 and later

  1. Go to More > Settings > Export > Add Syslog server.

  2. Turn on Enable syslog settings to send events.

  3. In Log settings, select Detection and Audit. Do not select Notification: notifications are sent as plain text and cannot be combined with other events.

  4. Host: the IP address of your ThreatDefence syslog appliance.

  5. Port: the port allocated for this log source (see the Syslog Onboarding Guide).

  6. Version: Syslog.

  7. Format: JSON.

  8. Transport protocol: the protocol your ThreatDefence syslog appliance listens on for this source (UDP or TCP).

  9. Click Finish.

ESET PROTECT On-Prem 13.0 and earlier

  1. Go to More > Settings > Advanced Settings > Syslog server and turn on Use Syslog server.

  2. Set Host (IP address of your ThreatDefence syslog appliance), Port (see the Syslog Onboarding Guide), Format of the log: Syslog, and Transport protocol (UDP or TCP).

  3. Scroll down to Logging, turn on Export logs to Syslog, and set the export format to JSON.

  4. Click Save.

Step 2. Reach out to ThreatDefence support

Once configuration is complete, provide the following details to ThreatDefence Support at 📧 support@threatdefence.com:

  • Request to enable ESET EDR syslog listener on your ThreatDefence appliance

  • Whether you use ESET PROTECT (cloud) or ESET PROTECT On-Prem, and the port configured in Step 1

  • Source IP address

API Setup with ESET Connect

Prerequisites

  • Access to the ESET PROTECT Hub with Superuser permissions.

Requirements and limitations

  • Only the Root or Superuser can create a user with access to API endpoints.

  • API access rights cannot be granted to the ESET Business Account Superuser, ESET MSP Administrator 2 Root user, and ESET PROTECT Hub Superuser accounts.

Steps

Step 1. Create an API User Account

  • We recommend creating a dedicated API user to separate your regular account from API activities.

  • Follow this guide and create the API user account.

  • Visit ESET online help page for more information.

Onboarding the integration

Please follow the Managing Integrations instructions and onboard the integration. The above saved credentailas are required in this process.

If encountered difficulties with onboarding, please email the following credentials to support@threatdefence.com

  • Your ESET account Username and Password

PreviousCisco AMP for Endpoints
NextThreatLocker

Last updated