ESET Inspect Onprem v3

ESET Inspect On-Prem v3 is an endpoint detection and response solution that provides advanced threat detection and investigation capabilities.

ESET Inspect On-Prem is a robust endpoint detection and response (EDR) solution designed to provide deep visibility into endpoint activities and potential threats. This connector allows Swimlane Turbine users to seamlessly integrate with ESET Inspect On-Prem, enabling the retrieval and management of security detections. By leveraging this integration, users can automate the extraction and normalization of threat data, enhancing their security operations with precise and actionable insights.

Prerequisites

Before you can use the ESET Inspect On-Prem v3 connector for Turbine, you'll need access to the ESET Inspect API. This requires the following:

HTTP Bearer authentication using the following parameters:

URL: The endpoint URL for accessing the ESET Inspect API.

Username: Your ESET Inspect account username.

Password: The password associated with your ESET Inspect account.

Capabilities

This Connector provides the following capabilities:

Capabilities

Here

e.g. Manage Firewall Policies instead of listing each individual tasks

Limitations

Include information about known limitations here, including supported or minimum versions, especially known unsupported versions.

Asset Setup

The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors.

Tasks Setup

Special task setup as needed depending on plugin, exclude if empty.

Known available allowed input options from enum type selection

Notes

Any other notes not fitting other sections go here.

Any reference URLs to external docs or other resources

Configurations

ESET Inspect On-Prem Authentication

Authenticates against the ESET Inspect On-Prem REST API using username and password to obtain a Bearer token.

Configuration Parameters

Parameter	Description	Type	Required
url	Base URL of the ESET Inspect On-Prem server (e.g. https://your-eset-server).	string	Required
username	ESET Inspect On-Prem username.	string	Required
password	ESET Inspect On-Prem password.	string	Required
domain	Whether the user account belongs to a domain. Set to true for domain accounts, false for local accounts.	boolean	Optional
verify_ssl	Verify SSL certificate of the ESET server.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

List Detections

Retrieve a paginated, filterable list of ESET Inspect On-Prem detections with options for sorting and filtering. Optionally returns results as normalized Turbine Schema alerts.

Endpoint

URL: /api/v1/detections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$top	integer	Optional	Maximum number of detections to return in a single response.
parameters.$skip	integer	Optional	Number of detections to skip (for pagination).
parameters.$count	integer	Optional	If set to 1, returns only the total count of matching detections instead of their full detail.
parameters.$orderBy	string	Optional	Sort detections by a field and direction. Example: "creationTime desc" or "severity asc".
parameters.$filter	string	Optional	OData filter expression using fields id, resolved, creationTime and operators eq, ne, gt, ge, lt, le, and, or, (). Example: "resolved eq false and creationTime ge 2024-01-01T00:00:00Z"
parameters.return_as_turbine_schema	boolean	Optional	If true, maps each detection to a normalized Turbine Schema alert instead of returning the raw API response.
parameters.alert_organization	string	Optional	Optional organization name to embed in Turbine Schema alerts. Only used when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract from each detection. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. Omit or leave empty to extract all types.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded from extraction.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each detection before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].

Input Example

{"parameters":{"$top":123,"$skip":123,"$count":123,"$orderBy":"string","$filter":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}

Output

Parameter	Type	Description
status_code	integer	HTTP status code of the API response.
count	integer	Total number of detections matching the query.
value	array	Raw list of detection objects (when return_as_turbine_schema is false).
value.uuid	string	Unique detection identifier.
value.id	integer	Unique detection identifier in the ESET Inspect Database.
value.creationTime	string	Time of the detection (ISO 8601).
value.computerId	integer	Computer's unique identifier in the ESET Inspect Database.
value.computerName	string	Name of the computer that raised the detection.
value.computerUuid	string	Computer's UUID in the ESET Inspect Database.
value.ruleName	string	Name of the rule that triggered the detection.
value.ruleId	integer	Integer ID of the rule.
value.ruleUuid	string	UUID of the rule.
value.severity	string	Detection severity label.
value.severityScore	integer	Precise severity score: 1-39 = Info, 40-69 = Warning, 70-100 = Threat.
value.type	integer	ESET detection type: 0=UnknownAlarm, 1=RuleActivated, 2=MalwareFoundOnDisk, 3=MalwareFoundInMemory, 4=ExploitDetected, 5=FirewallDetection, 7=BlockedAddress, 8=CryptoBlockerDetection.
value.resolved	boolean	Whether the detection has been marked resolved.
value.threatName	string	Name of the threat.
value.threatUri	string	URI that caused the detection to trigger.
value.processId	integer	Unique process identifier in the ESET Inspect Database.
value.processUser	string	User account logged on at the time of the detection trigger.
value.processCommandLine	string	Command-line arguments used with the process.
value.moduleName	string	Executable that triggered the detection.
value.moduleId	integer	Unique executable identifier in the ESET Inspect Database.
value.moduleSha1	string	SHA1 hash of the executable that triggered the detection.
value.moduleLgAge	integer	Number of days visible in LiveGrid.

Output Example

{"count":123,"value":[{"uuid":"12345678-1234-1234-1234-123456789abc","id":123,"creationTime":"string","computerId":123,"computerName":"Example Name","computerUuid":"string","ruleName":"Example Name","ruleId":123,"ruleUuid":"string","severity":"string","severityScore":123,"type":123,"resolved":true,"threatName":"Example Name","threatUri":"string"}],"Alerts":[{"alert_uid":"string","alert_title":"string","alert_description":"string","alert_severity":"string","alert_risk_score":123,"alert_created_ti...

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT