Eset Connect

ESET Connect integrates ESET's security intelligence with third-party platforms to enhance threat detection and response.

ESET is a global leader in cybersecurity, providing comprehensive protection for businesses and consumers. The Eset Connect connector allows Swimlane Turbine users to seamlessly integrate with ESET's security solutions, enabling automated retrieval and management of device and cloud office security detections. This integration enhances security operations by providing real-time insights and streamlined workflows, allowing users to efficiently manage threats and incidents within their environment.

Prerequisites

Before you can use the ESET Connect connector for Turbine, you'll need access to the ESET Business Account IAM service. This requires the following:

OAuth 2.0 password grant flow authentication using the following parameters:

Base URL: The base endpoint for accessing ESET services.

Token URL: The URL used to obtain the OAuth token.

Username: Your ESET Business Account username.

Password: Your ESET Business Account password.

Capabilities

This Connector provides the following capabilities:

Capabilities

Here

e.g. Manage Firewall Policies instead of listing each individual tasks

Limitations

Include information about known limitations here, including supported or minimum versions, especially known unsupported versions.

Asset Setup

The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors.

Tasks Setup

Special task setup as needed depending on plugin, exclude if empty.

Known available allowed input options from enum type selection

Notes

Any other notes not fitting other sections go here.

Any reference URLs to external docs or other resources

Configurations

ESET Connect OAuth 2.0 Password Grant

Authenticates against the ESET Business Account IAM service using the OAuth 2.0 password grant flow.

Configuration Parameters

Parameter	Description	Type	Required
url	Base URL of the ESET Incident Management API for your region. Europe: https://eu.incident-management.eset.systems Germany: https://de.incident-management.eset.systems United States: https://us.incident-management.eset.systems Canada: https://ca.incident-management.eset.systems Japan: https://jpn.incident-management.eset.systems	string	Required
token_url	OAuth 2.0 token endpoint for your region. Europe: https://eu.business-account.iam.eset.systems/oauth/token Germany: https://de.business-account.iam.eset.systems/oauth/token United States: https://us.business-account.iam.eset.systems/oauth/token Canada: https://ca.business-account.iam.eset.systems/oauth/token Japan: https://jpn.business-account.iam.eset.systems/oauth/token	string	Required
oauth2_username	The ESET Business Account username (email address) used for authentication. Ensure this API user has logged in to the ESET Cloud Office Security instance at least once before use.	string	Required
oauth2_password	The password for the ESET Business Account user.	string	Required
verify_ssl	Verify SSL certificate on requests.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

List Detections V1

Retrieve paginated ESET device detections from the v1 API, filtering by device, time range, and page. Optionally return results as normalized Turbine Schema alerts.

Endpoint

URL: /v1/detections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.deviceUuid	string	Optional	Include only detections that occurred on the referenced device.
parameters.startTime	string	Optional	Include only incidents whose detections occurred after start_time (including). detection.occur_time >= start_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00
parameters.endTime	string	Optional	Include only incidents whose detections occurred before end_time (excluding). detection.occur_time < end_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00
parameters.pageSize	integer	Optional	Limit for pagination purposes. If unspecified or 0, the default value is 50. The maximum value is 1000; values above 1000 will be coerced to 1000.
parameters.pageToken	string	Optional	Page token of the current page. If not given or empty string, the first page is returned.
parameters.return_as_turbine_schema	boolean	Optional	When true, detections are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, raw ESET detections are returned in the detections field.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].

Input Example

{"parameters":{"deviceUuid":"string","startTime":"string","endTime":"string","pageSize":123,"pageToken":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}

Output

Parameter	Type	Description
status_code	integer	HTTP status code of the response.
detections	array	Raw ESET detections. Populated when return_as_turbine_schema is false.
detections.uuid	string	Unique identifier
detections.displayName	string	Name of the resource
detections.typeName	string	Name of the resource
detections.category	string	Output field: detections.category
detections.severityLevel	string	Output field: detections.severityLevel
detections.occurTime	string	Time value
detections.objectName	string	Name of the resource
detections.objectHashSha1	string	Output field: detections.objectHashSha1
detections.objectTypeName	string	Name of the resource
detections.objectUrl	string	URL endpoint for the request
detections.context	object	Output field: detections.context
detections.context.circumstances	string	Output field: detections.context.circumstances
detections.context.deviceUuid	string	Unique identifier
detections.context.userName	string	Name of the resource
detections.context.process	object	Output field: detections.context.process
detections.context.process.path	string	Output field: detections.context.process.path
detections.networkCommunication	object	Output field: detections.networkCommunication
detections.networkCommunication.direction	string	Output field: detections.networkCommunication.direction
detections.networkCommunication.localIpAddress	string	Output field: detections.networkCommunication.localIpAddress
detections.networkCommunication.localPort	integer	Output field: detections.networkCommunication.localPort
detections.networkCommunication.remoteIpAddress	string	Output field: detections.networkCommunication.remoteIpAddress
detections.networkCommunication.remotePort	integer	Output field: detections.networkCommunication.remotePort
detections.networkCommunication.protocolName	string	Name of the resource

Output Example

{"detections":[{"uuid":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","typeName":"Example Name","category":"string","severityLevel":"string","occurTime":"string","objectName":"Example Name","objectHashSha1":"string","objectTypeName":"Example Name","objectUrl":"string","context":{},"networkCommunication":{},"responses":[]}],"Alerts":[{"alert_uid":"string","alert_title":"string","alert_description":"string","alert_severity":"string","alert_created_timestamp":"string","alert_st...

List Detections V2

Retrieve paginated ESET Cloud Office Security detections from the v2 API, filtering by tenant, time range, and page. Optionally return results as normalized Turbine Schema alerts. Not available in Japan.

Endpoint

URL: /v2/detections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.cloudOfficeTenantUuid	string	Optional	Reference to cloud office tenant whose detections should appear in the response. If empty or null, detections of any cloud office tenant will be returned. For device detections, it should be null or empty.
parameters.startTime	string	Optional	Include only incidents whose detections occurred after start_time (including). detection.occur_time >= start_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00
parameters.endTime	string	Optional	Include only incidents whose detections occurred before end_time (excluding). detection.occur_time < end_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00
parameters.pageSize	integer	Optional	Limit for pagination purposes. If unspecified or 0, the default value is 50. The maximum value is 1000; values above 1000 will be coerced to 1000.
parameters.pageToken	string	Optional	Page token of the current page. If not given or empty string, the first page is returned.
parameters.return_as_turbine_schema	boolean	Optional	When true, detections are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, raw ESET detections are returned in the detections field.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].

Input Example

{"parameters":{"cloudOfficeTenantUuid":"string","startTime":"string","endTime":"string","pageSize":123,"pageToken":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}

Output

Parameter	Type	Description
status_code	integer	HTTP status code of the response.
detections	array	Raw ESET detections. Populated when return_as_turbine_schema is false.
detections.uuid	string	Unique identifier
detections.displayName	string	Name of the resource
detections.typeName	string	Name of the resource
detections.category	string	Output field: detections.category
detections.severityLevel	string	Output field: detections.severityLevel
detections.severityScore	number	Score value
detections.occurTime	string	Time value
detections.resolved	boolean	Output field: detections.resolved
detections.userName	string	Name of the resource
detections.objectName	string	Name of the resource
detections.objectHashSha1	string	Output field: detections.objectHashSha1
detections.objectSizeBytes	string	Output field: detections.objectSizeBytes
detections.objectTypeName	string	Name of the resource
detections.objectUrl	string	URL endpoint for the request
detections.circumstances	string	Output field: detections.circumstances
detections.note	string	Output field: detections.note
detections.scanUuid	string	Unique identifier
detections.edrRuleUuid	string	Unique identifier
detections.cloudOfficeTenantUuid	string	Unique identifier
detections.device	object	Output field: detections.device
detections.device.uuid	string	Unique identifier
detections.device.displayName	string	Name of the resource
detections.process	object	Output field: detections.process

Output Example

{"detections":[{"uuid":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","typeName":"Example Name","category":"string","severityLevel":"string","severityScore":123,"occurTime":"string","resolved":true,"userName":"Example Name","objectName":"Example Name","objectHashSha1":"string","objectSizeBytes":"string","objectTypeName":"Example Name","objectUrl":"string","circumstances":"string"}],"Alerts":[{"alert_uid":"string","alert_title":"string","alert_description":"string","alert_sev...

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT