elastic / elastic/integrations

[eset_protect] detection enhancements

Open
#18,358 1 comment 0 reactions 0 assignees View on GitHub
enhancement Integration:eset_protect Team:SDE-Crest Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

In ESET, detection logs can be sourced from different places such as EPC (ESET Protect), EIC (ESET Inspect), and ECOS (ESET Cloud Office Security) detections.

According to ESET:
- `/v1/detections` — returns a list of detections collected from EPC and EIC.
- `/v2/detections` — returns a list of detections collected from ECOS only.

The [v1 version](https://help.eset.com/eset_connect/en-US/incident_management_v1_detections_get.html#s-responses) provides fewer details about detection logs, whereas the [v2 version](https://help.eset.com/eset_connect/en-US/incident_management_v2_detections_get.html#s-responses) provides more granular details about detections.

Also, the `/v2/detections/{uuid}` endpoint accepts any detection ID (regardless of whether it is an EPC or EIC detection ID) and returns a response with more granular details.

Since our integration currently uses `/v1/detections` to collect detection logs, we can improve the integration in the following ways:
1. Implement `/v1/detections + /v2/detections/{uuid}` — this will provide EPC/EIC detections with more in-depth details.
2. Implement `/v2/detections` — this will provide ECOS detections, which were missing earlier.
Both approaches together can provide all types of logs in a detailed way.

There is also a v3 API version planned, which will provide all EPC/EIC/ECOS detection logs in a single endpoint. However, it has not been released yet — it is coming in the near future.

The v3 release should be announced here: https://help.eset.com/eset_connect/en-US/release_notes.html

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.