> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ESET OnPrem

> Connect ThreatAware to ESET OnPrem to monitor endpoint security and threat detection

## Overview

The ESET OnPrem integration enables ThreatAware to collect data from your ESET OnPrem deployment, providing visibility into endpoint security posture and threat detection status across your organisation.

<Info>
  **Connection Method**: API
  **Setup Time**: 10 minutes
  **Access Required**: ESET Administrator account
</Info>

## Data collected

The ESET OnPrem integration provides:

* Endpoint security status
* Threat detection events
* Malware and detection logs
* Protection status across devices

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Security Monitoring" icon="shield-halved">
    Track ESET protection status across all managed endpoints
  </Card>

  <Card title="Threat Detection" icon="triangle-exclamation">
    Monitor malware detections and security events in real-time
  </Card>

  <Card title="Compliance Validation" icon="clipboard-check">
    Verify endpoint protection is active on required systems
  </Card>

  <Card title="Incident Response" icon="fire">
    Correlate ESET threat data with device inventory for faster response
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    Access the ThreatAware dashboard and navigate to **Settings** > **Integrations**.
  </Step>

  <Step title="Find and Select ESET OnPrem">
    Use the search bar to find **ESET OnPrem** in the integrations list and click **Connect**.

    A configuration dialog will appear.
  </Step>

  <Step title="Enter ESET Server Details">
    Provide the following information:

    * **API Token**: The API token provided by ESET for integration access
    * **Server IP Address**: The IP address of your ESET OnPrem server

    <Tip>
      Contact your ESET administrator if you need help obtaining the API token or server IP address.
    </Tip>
  </Step>

  <Step title="Configure API Permissions">
    Ensure that the API token has the appropriate permissions configured in ESET:

    * Read access to endpoint data
    * Read access to threat logs
    * Read access to device inventory

    For more details, refer to ESET's [API documentation](https://www.eset.com/us/support/apidocs/).
  </Step>

  <Step title="Complete the Connection">
    Click **Connect** to establish the integration. ThreatAware will test the connection.
  </Step>

  <Step title="Verify Connection Status">
    Once connected, verify the connection status in ThreatAware under **Connected Systems**.

    Ensure all data from ESET OnPrem is visible and up to date in your dashboard.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Token" icon="key">
    **Field Name**: ESET API Token
    **Type**: Password (encrypted)
    **Description**: The API token generated in ESET OnPrem for integration access

    <Tip>
      Store this credential securely in your organisation's password manager.
    </Tip>
  </Accordion>

  <Accordion title="Server IP Address" icon="server">
    **Field Name**: ESET Server IP
    **Type**: String
    **Description**: The IP address of your ESET OnPrem server

    **Example**: `192.168.1.100` or `10.0.0.50`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the ESET OnPrem integration shows **Active** status

2. **Verify Data Collection**
   * Wait up to 1 hour for initial data sync
   * Check that ESET device data appears in your inventory

3. **Test Queries**
   * Create a test query to filter devices by ESET protection status
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Incorrect API Token or IP Address" icon="triangle-exclamation">
    **Symptoms**: Connection fails immediately or shows authentication error

    **Solutions**:

    * Verify the **API Token** is entered correctly without extra spaces
    * Confirm the **Server IP Address** is accessible and correct
    * Test connectivity to the ESET server from your network
    * Contact your ESET administrator to regenerate the API token if needed
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the ESET server is online and accessible
    * Check firewall rules allow outbound access to the ESET server
    * Confirm the server IP address is reachable from your ThreatAware instance
    * Test the connection using a network connectivity tool
  </Accordion>

  <Accordion title="No Data Appearing" icon="database">
    **Symptoms**: Integration shows active but no ESET data appears

    **Solutions**:

    * Verify there is endpoint data in ESET to collect
    * Check the API token has read access to endpoint data
    * Wait up to 1 hour for the initial data sync
    * Review ThreatAware integration logs for errors
  </Accordion>

  <Accordion title="Permission Errors" icon="ban">
    **Symptoms**: Integration connects but returns permission denied errors

    **Solutions**:

    * Verify the API token has read permissions to:
      * Endpoint data
      * Threat logs
      * Device inventory
    * Refer to ESET's API documentation for required permissions
    * Contact ESET support to verify token permissions
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="ESET API Documentation" icon="book" href="https://www.eset.com/us/support/apidocs/">
    Official ESET API documentation for detailed configuration and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Store the API token securely in your password manager
  * Rotate API tokens annually or per your security policy
  * Monitor for authentication failures in ThreatAware logs
  * Use a dedicated API token for ThreatAware integration
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read permissions to the API token
  * Limit API token scope to necessary data endpoints
  * Review ESET audit logs periodically to monitor API usage
  * Follow your organisation's least privilege principles
</Tip>