{ "name": "ESETConnectConnector", "apiVersion": "2025-07-01-preview", "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "ESETConnectConnector", "title": "ESET Connect Data Connector (via Codeless Connector Framework)", "publisher": "ESET", "descriptionMarkdown": "The ESET Connect data connector enables comprehensive security monitoring by ingesting threat detections and incident data from multiple ESET products through the ESET Connect REST API. All detections from ESET PROTECT, ESET Inspect, and ESET Cloud Office Security are unified into the Detections table, with ESET PROTECT and Inspect providing basic endpoint detections via the /v1/detections API, while ESET Cloud Office Security delivers enhanced email security detections through the /v2/detections API. Additionally, incident management data from ESET Inspect is collected into the Incidents table via the /v2/incidents endpoint, providing enhanced incident correlation and management capabilities. The connector uses ESET Connect API credentials with username and password authentication, requiring an API user account with appropriate permissions for your selected products. Before using this connector, ensure you have an ESET Connect API user account, access to your selected ESET products (EP/EI/ECOS), appropriate API permissions for data access, and note that ESET Cloud Office Security is not supported in the Japan region.", "graphQueriesTableName": "IntegrationTableV2", "graphQueries": [ { "metricName": "Total ESET detections received", "legend": "ESET Connect Data", "baseQuery": "IntegrationTableV2" }, { "metricName": "Total ESET incidents received", "legend": "ESET Incidents", "baseQuery": "IntegrationTableIncidentsV2" }, { "metricName": "Total ESET Inspect detections received", "legend": "ESET Inspect", "baseQuery": "ESETInspectV2" } ], "sampleQueries": [ { "description": "All ESET detections", "query": "IntegrationTableV2\n| sort by TimeGenerated desc" }, { "description": "Get sample of ESET detections", "query": "IntegrationTableV2\n| take 10" }, { "description": "Summary by severity level", "query": "IntegrationTableV2\n| summarize count() by SeverityLevel" } ], "dataTypes": [ { "name": "IntegrationTableV2", "lastDataReceivedQuery": "IntegrationTableV2\n| where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { "name": "IntegrationTableIncidentsV2", "lastDataReceivedQuery": "IntegrationTableIncidentsV2\n| where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { "name": "ESETInspectV2", "lastDataReceivedQuery": "ESETInspectV2\n| where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": true, "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true, "action": false } } ], "customs": [ { "name": "ESET Connect API access", "description": "Access to ESET Connect API with appropriate permissions for selected products is required." } ] }, "instructionSteps": [ { "title": "1. Connector Management", "description": "Manage your ESET Connect connector instances", "instructions": [ { "type": "Markdown", "parameters": { "content": "## ESET Connect Instances\n\nManage multiple ESET Connect connector instances. Each instance can monitor different ESET products and connect to different environments or regions." } }, { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Connector Name", "columnValue": "properties.addOnAttributes.friendlyName" }, { "columnName": "Product", "columnValue": "properties.addOnAttributes.productIds" }, { "columnName": "Base URL", "columnValue": "properties.request.apiEndpoint" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "label": "Add Connector", "title": "Add ESET Connect Connector", "subtitle": "Connect to ESET Connect API", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "instructions": [ { "type": "Markdown", "parameters": { "content": "## Product Selection\n\nSelect which ESET product this connector instance will monitor. Create separate instances for each product you want to monitor." } }, { "type": "Dropdown", "parameters": { "label": "Deployment Mode", "name": "deploymentMode", "options": [ { "key": "Cloud", "text": "Cloud" }, { "key": "On-Premise", "text": "On-Premise" } ], "required": true } }, { "type": "Dropdown", "parameters": { "label": "ESET Product", "name": "productIds", "options": [ { "key": "EP", "text": "ESET PROTECT (EP)" }, { "key": "EI", "text": "ESET Inspect (EI)" }, { "key": "ECOS", "text": "ESET Cloud Office Security (ECOS)" } ], "required": true } }, { "type": "InfoMessage", "parameters": { "text": "**Product Details:**\n- **ESET PROTECT**: Endpoint detections via /v1/detections\n- **ESET Inspect**: Detections via /v1/detections + Incidents via /v2/incidents\n- **ESET Cloud Office Security**: Email security detections via /v2/detections (not available in Japan region)", "visible": true, "inline": true } }, { "type": "Markdown", "parameters": { "content": "## API Configuration\n\nConfigure your ESET Connect API endpoint and credentials." } }, { "type": "Textbox", "parameters": { "label": "Start From Detection ID (Optional)", "placeholder": "0", "type": "number", "name": "startFromDetectionId" } }, { "type": "Markdown", "parameters": { "content": "> **Optional:** Specify a detection ID to start from. Leave empty to collect all detections. This filter is applied in addition to the automatic time-based tracking." } }, { "type": "Textbox", "parameters": { "label": "ESET Connect API Base URL", "placeholder": "https://us.incident-management.eset.systems", "type": "text", "name": "esetBaseUrl", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "**Important**: Enter the regional ESET Connect API base URL (not the portal URL). Common examples:\n- United States: `https://us.incident-management.eset.systems`\n- Europe: `https://eu.incident-management.eset.systems`\n- Japan: `https://jpn.incident-management.eset.systems`\n- On-Premise ESET Inspect: Enter your server URL (e.g., `https://your-server:8443`)", "visible": true, "inline": false } }, { "type": "Markdown", "parameters": { "content": "## Authentication\n\nProvide your ESET Connect API credentials." } }, { "type": "Textbox", "parameters": { "label": "ESET Token Endpoint Base URL", "placeholder": "https://eu.business-account.iam.eset.systems", "type": "text", "name": "tokenEndpoint", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "**Token endpoint** (without /oauth/token):\n- EU: `https://eu.business-account.iam.eset.systems`\n- US: `https://us.business-account.iam.eset.systems`\n- JP: `https://jpn.business-account.iam.eset.systems`", "visible": true, "inline": false } }, { "type": "Textbox", "parameters": { "label": "ESET API Username", "placeholder": "Enter your ESET Connect API username (email)", "type": "email", "name": "username", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "ESET API Password", "placeholder": "Enter your ESET Connect API password", "type": "password", "name": "password", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Client ID", "placeholder": "eset-sentinel-ccf", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Client Secret", "placeholder": "Enter any non-empty value", "type": "password", "name": "clientSecret", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "**Client ID/Secret**: ESET ignores these. Enter any non-empty values.", "visible": true, "inline": true } }, { "type": "InfoMessage", "parameters": { "text": "**ECOS Requirement**: If using ESET Cloud Office Security, you must log into the ECOS instance with these API credentials at least once before data collection will work.", "visible": true, "inline": false } }, { "type": "Textbox", "parameters": { "label": "Connector Friendly Name", "placeholder": "Enter a unique friendly name for this connector", "type": "text", "name": "friendlyName", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "The friendly name helps you identify this connector instance in the grid and in the collected data.", "visible": true, "inline": true } }, { "type": "InfoMessage", "parameters": { "text": "**Data Collection Schedule**: The connector will poll for new data every 15 minutes per selected product.", "visible": true, "inline": true } } ] } ] } } ] } ] } } }