--- title: Eset Connect slug: connectors/eset-connect docTags: createdAt: 2026-06-09T16:30:02.251Z --- ESET Connect integrates ESET's security intelligence with third-party platforms to enhance threat detection and response. ESET is a global leader in cybersecurity, providing comprehensive protection for businesses and consumers. The Eset Connect connector allows Swimlane Turbine users to seamlessly integrate with ESET's security solutions, enabling automated retrieval and management of device and cloud office security detections. This integration enhances security operations by providing real-time insights and streamlined workflows, allowing users to efficiently manage threats and incidents within their environment. ## Prerequisites Before you can use the ESET Connect connector for Turbine, you'll need access to the ESET Business Account IAM service. This requires the following: - OAuth 2.0 password grant flow authentication using the following parameters: - Base URL: The base endpoint for accessing ESET services. - Token URL: The URL used to obtain the OAuth token. - Username: Your ESET Business Account username. - Password: Your ESET Business Account password. ## Capabilities This Connector provides the following capabilities: - Capabilities - Go - Here - e.g. Manage Firewall Policies instead of listing each individual tasks ### Limitations Include information about known limitations here, including supported or minimum versions, especially known unsupported versions. ## Asset Setup The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors. ## Tasks Setup Special task setup as needed depending on plugin, exclude if empty. Known available allowed input options from enum type selection ## Notes - Any other notes not fitting other sections go here. - Any reference URLs to external docs or other resources # Configurations ## ESET Connect OAuth 2.0 Password Grant Authenticates against the ESET Business Account IAM service using the OAuth 2.0 password grant flow. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | Base URL of the ESET Incident Management API for your region. Europe: [https://eu.incident-management.eset.systems](https://eu.incident-management.eset.systems) Germany: [https://de.incident-management.eset.systems](https://de.incident-management.eset.systems) United States: [https://us.incident-management.eset.systems](https://us.incident-management.eset.systems) Canada: [https://ca.incident-management.eset.systems](https://ca.incident-management.eset.systems) Japan: [https://jpn.incident-management.eset.systems](https://jpn.incident-management.eset.systems) | string | Required | | token\_url | OAuth 2.0 token endpoint for your region. Europe: [https://eu.business-account.iam.eset.systems/oauth/token](https://eu.business-account.iam.eset.systems/oauth/token) Germany: [https://de.business-account.iam.eset.systems/oauth/token](https://de.business-account.iam.eset.systems/oauth/token) United States: [https://us.business-account.iam.eset.systems/oauth/token](https://us.business-account.iam.eset.systems/oauth/token) Canada: [https://ca.business-account.iam.eset.systems/oauth/token](https://ca.business-account.iam.eset.systems/oauth/token) Japan: [https://jpn.business-account.iam.eset.systems/oauth/token](https://jpn.business-account.iam.eset.systems/oauth/token) | string | Required | | oauth2\_username | The ESET Business Account username (email address) used for authentication. Ensure this API user has logged in to the ESET Cloud Office Security instance at least once before use. | string | Required | | oauth2\_password | The password for the ESET Business Account user. | string | Required | | verify\_ssl | Verify SSL certificate on requests. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## List Detections V1 Retrieve paginated ESET device detections from the v1 API, filtering by device, time range, and page. Optionally return results as normalized Turbine Schema alerts. ### Endpoint - **URL:** `/v1/detections` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.deviceUuid` | string | Optional | Include only detections that occurred on the referenced device. | | `parameters.startTime` | string | Optional | Include only incidents whose detections occurred after start\_time (including). detection.occur\_time >= start\_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00 | | `parameters.endTime` | string | Optional | Include only incidents whose detections occurred before end\_time (excluding). detection.occur\_time \< end\_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00 | | `parameters.pageSize` | integer | Optional | Limit for pagination purposes. If unspecified or 0, the default value is 50. The maximum value is 1000; values above 1000 will be coerced to 1000. | | `parameters.pageToken` | string | Optional | Page token of the current page. If not given or empty string, the first page is returned. | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, detections are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, raw ESET detections are returned in the detections field. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | ### Input Example `{"parameters":{"deviceUuid":"string","startTime":"string","endTime":"string","pageSize":123,"pageToken":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | ------------------------------------------------------------------------- | | `status_code` | integer | HTTP status code of the response. | | `detections` | array | Raw ESET detections. Populated when return\_as\_turbine\_schema is false. | | `detections.uuid` | string | Unique identifier | | `detections.displayName` | string | Name of the resource | | `detections.typeName` | string | Name of the resource | | `detections.category` | string | Output field: detections.category | | `detections.severityLevel` | string | Output field: detections.severityLevel | | `detections.occurTime` | string | Time value | | `detections.objectName` | string | Name of the resource | | `detections.objectHashSha1` | string | Output field: detections.objectHashSha1 | | `detections.objectTypeName` | string | Name of the resource | | `detections.objectUrl` | string | URL endpoint for the request | | `detections.context` | object | Output field: detections.context | | `detections.context.circumstances` | string | Output field: detections.context.circumstances | | `detections.context.deviceUuid` | string | Unique identifier | | `detections.context.userName` | string | Name of the resource | | `detections.context.process` | object | Output field: detections.context.process | | `detections.context.process.path` | string | Output field: detections.context.process.path | | `detections.networkCommunication` | object | Output field: detections.networkCommunication | | `detections.networkCommunication.direction` | string | Output field: detections.networkCommunication.direction | | `detections.networkCommunication.localIpAddress` | string | Output field: detections.networkCommunication.localIpAddress | | `detections.networkCommunication.localPort` | integer | Output field: detections.networkCommunication.localPort | | `detections.networkCommunication.remoteIpAddress` | string | Output field: detections.networkCommunication.remoteIpAddress | | `detections.networkCommunication.remotePort` | integer | Output field: detections.networkCommunication.remotePort | | `detections.networkCommunication.protocolName` | string | Name of the resource | ### Output Example `{"detections":[{"uuid":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","typeName":"Example Name","category":"string","severityLevel":"string","occurTime":"string","objectName":"Example Name","objectHashSha1":"string","objectTypeName":"Example Name","objectUrl":"string","context":{},"networkCommunication":{},"responses":[]}],"Alerts":[{"alert_uid":"string","alert_title":"string","alert_description":"string","alert_severity":"string","alert_created_timestamp":"string","alert_st...` ## List Detections V2 Retrieve paginated ESET Cloud Office Security detections from the v2 API, filtering by tenant, time range, and page. Optionally return results as normalized Turbine Schema alerts. Not available in Japan. ### Endpoint - **URL:** `/v2/detections` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.cloudOfficeTenantUuid` | string | Optional | Reference to cloud office tenant whose detections should appear in the response. If empty or null, detections of any cloud office tenant will be returned. For device detections, it should be null or empty. | | `parameters.startTime` | string | Optional | Include only incidents whose detections occurred after start\_time (including). detection.occur\_time >= start\_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00 | | `parameters.endTime` | string | Optional | Include only incidents whose detections occurred before end\_time (excluding). detection.occur\_time \< end\_time. Use timestamp in UTC or offset format. Examples: 2024-10-30T12:00Z or 2024-10-30T10:00+02:00 | | `parameters.pageSize` | integer | Optional | Limit for pagination purposes. If unspecified or 0, the default value is 50. The maximum value is 1000; values above 1000 will be coerced to 1000. | | `parameters.pageToken` | string | Optional | Page token of the current page. If not given or empty string, the first page is returned. | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, detections are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, raw ESET detections are returned in the detections field. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | ### Input Example `{"parameters":{"cloudOfficeTenantUuid":"string","startTime":"string","endTime":"string","pageSize":123,"pageToken":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ------------------------------------------------------------------------- | | `status_code` | integer | HTTP status code of the response. | | `detections` | array | Raw ESET detections. Populated when return\_as\_turbine\_schema is false. | | `detections.uuid` | string | Unique identifier | | `detections.displayName` | string | Name of the resource | | `detections.typeName` | string | Name of the resource | | `detections.category` | string | Output field: detections.category | | `detections.severityLevel` | string | Output field: detections.severityLevel | | `detections.severityScore` | number | Score value | | `detections.occurTime` | string | Time value | | `detections.resolved` | boolean | Output field: detections.resolved | | `detections.userName` | string | Name of the resource | | `detections.objectName` | string | Name of the resource | | `detections.objectHashSha1` | string | Output field: detections.objectHashSha1 | | `detections.objectSizeBytes` | string | Output field: detections.objectSizeBytes | | `detections.objectTypeName` | string | Name of the resource | | `detections.objectUrl` | string | URL endpoint for the request | | `detections.circumstances` | string | Output field: detections.circumstances | | `detections.note` | string | Output field: detections.note | | `detections.scanUuid` | string | Unique identifier | | `detections.edrRuleUuid` | string | Unique identifier | | `detections.cloudOfficeTenantUuid` | string | Unique identifier | | `detections.device` | object | Output field: detections.device | | `detections.device.uuid` | string | Unique identifier | | `detections.device.displayName` | string | Name of the resource | | `detections.process` | object | Output field: detections.process | ### Output Example `{"detections":[{"uuid":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","typeName":"Example Name","category":"string","severityLevel":"string","severityScore":123,"occurTime":"string","resolved":true,"userName":"Example Name","objectName":"Example Name","objectHashSha1":"string","objectSizeBytes":"string","objectTypeName":"Example Name","objectUrl":"string","circumstances":"string"}],"Alerts":[{"alert_uid":"string","alert_title":"string","alert_description":"string","alert_sev...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |