> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/eset-edr.md).

# ESET EDR

The ThreatDefence platform supports integration with **ESET PROTECT** and **ESET Inspect Cloud** to ingest endpoint detection and response telemetry.\
Logs collected from ESET provide visibility into malware detections, suspicious activities, and endpoint risk events.

The platform supports integration using a syslog interface or with **ESET Connect,** an API gateway between a client and a collection of ESET backend services of the following modules: ESET PROTECT (Cloud), ESET Inspect, and ESET Cloud Office Security.

***

## Syslog Setup

***

## Prerequisites

* **ESET PROTECT (cloud):** access to the **ESET PROTECT Hub** with **Superuser** permissions.
* **ESET PROTECT On-Prem:** administrator access to the ESET PROTECT On-Prem web console.
* A ThreatDefence syslog appliance or VM.

***

## Steps

### Step 1. Syslog Configuration

ThreatDefence ingests ESET events as a **JSON** payload inside a **Syslog (RFC 5424)** envelope. Whichever ESET console you use, set these two options:

| Setting                                          | Value                 |
| ------------------------------------------------ | --------------------- |
| Format of payload (On-Prem: Format)              | **JSON**              |
| Format of envelope of the log (On-Prem: Version) | **Syslog** (RFC 5424) |

{% hint style="warning" %}
**Important:** Do not select **CEF**, **LEEF** or the **BSD** envelope. Events sent in those formats are not ingested.
{% endhint %}

**ESET PROTECT (cloud)**

1. Go to **Integrations** > **Marketplace**, find **Syslog Forwarder** and click **Connect**.
2. In **General settings**, set:
   * **Name**: for example, `ThreatDefence`.
   * **Format of payload**: **JSON**.
   * **Format of envelope of the log**: **Syslog**.
   * **Minimal log level**: **Information**, so that audit events are sent as well as detections.
   * **Destination IP or FQDN of TLS-compatible syslog server**: the public IP address or hostname of your ThreatDefence syslog appliance.
   * **Port**: the port allocated for this log source (see the Syslog Onboarding Guide).
   * **Octet-counted framing**: leave at the default (enabled).
3. Click **Continue**. In **Log Settings and Certificate**, select the **Event types to log** (Antivirus, HIPS, Firewall, Web protection, Audit Log, Blocked files, ESET Inspect alerts, Incidents). Turn on **Validate CA Root certificates of TLS connections** only if ThreatDefence support has given you a certificate chain to paste.
4. Click **Continue**, review the **Summary**, click **Test Log**, then click **Finish**. The configuration takes effect within 10 minutes.

{% hint style="info" %}
**Note:** ESET PROTECT (cloud) only sends syslog over TLS to a publicly reachable address. If your ThreatDefence syslog appliance is not reachable from the internet over TLS, contact ThreatDefence support before you configure this.
{% endhint %}

**ESET PROTECT On-Prem 13.1 and later**

1. Go to **More** > **Settings** > **Export** > **Add Syslog server**.
2. Turn on **Enable syslog settings to send events**.
3. In **Log settings**, select **Detection** and **Audit**. Do not select **Notification**: notifications are sent as plain text and cannot be combined with other events.
4. **Host**: the IP address of your ThreatDefence syslog appliance.
5. **Port**: the port allocated for this log source (see the Syslog Onboarding Guide).
6. **Version**: **Syslog**.
7. **Format**: **JSON**.
8. **Transport protocol**: the protocol your ThreatDefence syslog appliance listens on for this source (UDP or TCP).
9. Click **Finish**.

**ESET PROTECT On-Prem 13.0 and earlier**

1. Go to **More** > **Settings** > **Advanced Settings** > **Syslog server** and turn on **Use Syslog server**.
2. Set **Host** (IP address of your ThreatDefence syslog appliance), **Port** (see the Syslog Onboarding Guide), **Format of the log**: **Syslog**, and **Transport protocol** (UDP or TCP).
3. Scroll down to **Logging**, turn on **Export logs to Syslog**, and set the export format to **JSON**.
4. Click **Save**.

***

### Step 2. Reach out to ThreatDefence support

Once configuration is complete, provide the following details to **ThreatDefence Support** at 📧 [**support@threatdefence.com**](mailto:support@threatdefence.com):

* Request to enable ESET EDR syslog listener on your ThreatDefence appliance
* Whether you use ESET PROTECT (cloud) or ESET PROTECT On-Prem, and the port configured in Step 1
* Source IP address

***

## API Setup with ESET Connect

***

## Prerequisites

* Access to the **ESET PROTECT Hub** with **Superuser** permissions.

***

## Requirements and limitations <a href="#s-requirements-and-limitations" id="s-requirements-and-limitations"></a>

* Only the Root or Superuser can create a user with access to API endpoints.
* API access rights cannot be granted to the ESET Business Account Superuser, ESET MSP Administrator 2 Root user, and ESET PROTECT Hub Superuser accounts.

***

## Steps

### Step 1. Create an API User Account

* We recommend creating a dedicated API user to separate your regular account from API activities.
* Follow this [guide](https://help.eset.com/eset_connect/en-US/create_api_user_account.html) and create the API user account.
* Visit ESET online help [page](https://help.eset.com/eset_connect/en-US/index.html) for more information.

***

### **Onboarding the integration**

Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The above saved credentailas are required in this process.

***

If encountered difficulties with onboarding, please email the following credentials to <support@threatdefence.com>

* Your ESET account **Username** and **Password**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/eset-edr.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.