elastic / elastic/integrations
[eset_protect] detection enhancements
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
In ESET, detection logs can be sourced from different places such as EPC (ESET Protect), EIC (ESET Inspect), and ECOS (ESET Cloud Office Security) detections.
According to ESET:
- `/v1/detections` — returns a list of detections collected from EPC and EIC.
- `/v2/detections` — returns a list of detections collected from ECOS only.
The [v1 version](https://help.eset.com/eset_connect/en-US/incident_management_v1_detections_get.html#s-responses) provides fewer details about detection logs, whereas the [v2 version](https://help.eset.com/eset_connect/en-US/incident_management_v2_detections_get.html#s-responses) provides more granular details about detections.
Also, the `/v2/detections/{uuid}` endpoint accepts any detection ID (regardless of whether it is an EPC or EIC detection ID) and returns a response with more granular details.
Since our integration currently uses `/v1/detections` to collect detection logs, we can improve the integration in the following ways:
1. Implement `/v1/detections + /v2/detections/{uuid}` — this will provide EPC/EIC detections with more in-depth details.
2. Implement `/v2/detections` — this will provide ECOS detections, which were missing earlier.
Both approaches together can provide all types of logs in a detailed way.
There is also a v3 API version planned, which will provide all EPC/EIC/ECOS detection logs in a single endpoint. However, it has not been released yet — it is coming in the near future.
The v3 release should be announced here: https://help.eset.com/eset_connect/en-US/release_notes.html
Contributor guide
Assessment
This issue has not been assessed yet.