Skip to main content

​
Overview

The ESET Cloud integration enables ThreatAware to collect data from your ESET PROTECT Cloud deployment, providing visibility into endpoint security posture and threat detection status across your organisation.
Connection Method: API Setup Time: 20 minutes Access Required: ESET Administrator account

​
Data collected

The ESET Cloud integration provides:
  • Endpoint protection status
  • Threat detection and malware events
  • Security event logs
  • Device inventory from ESET
  • Compliance and policy status

​
Use cases

Cloud Endpoint Monitoring

Track ESET Cloud protection status across all managed endpoints

Threat Detection

Monitor malware detections and security events in real-time

Compliance Tracking

Verify endpoint protection is active on required systems

Incident Response

Correlate ESET threat data with device inventory for faster response

​
Setup instructions

1

Log in to ESET PROTECT Console

Access the ESET PROTECT Console with administrator credentials.
2

Create an API User

In the ESET PROTECT Console:
  • Navigate to More > Users
  • Click Add New User
  • Assign a descriptive name (e.g., “ThreatAware API User”)
  • Configure the user permissions with Read-only access for security
3

Generate an API Token

Create an API token for the user you just created:
  • Go to More > API > API Tokens
  • Click Generate Token
  • Link the token to the API User you created
  • Set the required permissions
  • Copy the API Token that is generated
The API Token will only be displayed once. Copy it immediately and store it securely.
4

Note Your Server URL

Identify your ESET PROTECT instance URL:
  • This is the base URL you use to access ESET PROTECT
  • Example: https://your-eset-instance.com
  • You’ll need this for ThreatAware configuration
5

Enter Credentials in ThreatAware

In ThreatAware:
  • Navigate to Settings > Integrations
  • Search for and select ESET Cloud
  • Enter the required credentials:
    • API Token: The token you copied from ESET
    • Server URL: Your ESET PROTECT instance URL
6

Connect and Verify

Click Connect to establish the integration.Verify the connection status shows Active in ThreatAware.

​
Required credentials

Field Name: ESET API Token Type: Password (encrypted) Description: The API token created in ESET PROTECT for integration access
Store this credential securely in your organisation’s password manager.
Field Name: ESET Server URL Type: String Description: The URL of your ESET PROTECT instanceFormat: https://your-eset-instance.com Example: https://eset.acme.com or https://protect.company.net

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the ESET Cloud integration shows Active status
  2. Verify Data Collection
    • Wait up to 1 hour for the initial data sync
    • Check that ESET device data appears in your inventory
    • Verify protection status and threat events are visible
  3. Test Queries
    • Create a test query to filter devices by ESET Cloud protection status
    • Verify threat and event data matches your ESET environment
    • Test filtering by compliance or policy status

​
Troubleshooting

Symptoms: Connection fails with authentication errorSolutions:
  • Verify the API token is entered correctly without extra spaces
  • Ensure the API token was copied completely from ESET PROTECT
  • Check that the API token has not expired
  • Verify the token is linked to the correct API user
  • Generate a new API token if needed
Symptoms: Integration connects but no data appearsSolutions:
  • Verify the API token has read permissions to:
    • Device inventory
    • Threat events
    • Protection status
  • Check the API user permissions in ESET PROTECT
  • Review the ESET API Documentation for required permissions
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Server URL is correct and accessible
  • Check firewall rules allow outbound HTTPS (443) to ESET
  • Test the URL in a browser to ensure it’s reachable
  • Verify your ESET PROTECT instance is online and responding
Symptoms: Integration shows active but no ESET data appearsSolutions:
  • Verify there is endpoint data in ESET PROTECT to collect
  • Check the API token has sufficient permissions
  • Wait up to 1 hour for the initial data sync
  • Review ThreatAware integration logs for errors
  • Verify your ESET environment has managed endpoints

​
Additional resources

ESET API Documentation

Official ESET documentation for API configuration and permissions

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated API user specifically for ThreatAware
  • Store the API token securely in your organisation’s password manager
  • Rotate API tokens annually or per your security policy
  • Monitor for authentication failures in ThreatAware logs
Security Considerations
  • Only grant read permissions to the API token
  • Limit API token scope to necessary data endpoints
  • Review ESET audit logs periodically to monitor API usage
  • Follow your organisation’s least privilege principles