Integrating with ESET Endpoint Protection

Overview

When configured, the Blumira and ESET integration will stream server and workstation endpoint security event logs and alerts to the Blumira service for threat detection and actionable response.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Obtain the IP address of your Blumira sensor to use when configuring the external service.

To gather the IP address of the sensor:

1. In Blumira, navigate to Settings > Sensors.
2. Click the sensor row to open the details page.
3. Under Overview, in the Host Details box, copy the IP value.

Sending ESET Protect log data to Blumira

The ESET integration relies on Blumira’s Sensor Logger Module, which acts as a Syslog server. Logger Module is set up by default for new sensors and does not require additional configuration in Blumira.

Export your ESET Protect log data to a Syslog server—your Blumira sensor—by completing the following steps:

1. Log in to your ESET Protect Console.
2. Click Admin > Server Settings and expand Advanced Settings.
3. In the Syslog Server section, complete the following steps:
   1. Enable Use Syslog server.
   2. In the Host field, type the IP address or hostname of your Blumira sensor.
   3. In the Port field, keep the default value 514.
4. In the Logging section, enable Export logs to Syslog.
5. Set the Log format to JSON.
6. Click Save.