Overview
ESET PROTECT (on-premises, formerly ESET Security Management Center and ESET Remote Administrator) is ESET's central management server for ESET endpoint products. This article explains how to forward ESET PROTECT events and notifications to Logsign Unified SecOps Platform via syslog. For the cloud-hosted ESET PROTECT, see the separate Eset Protect Cloud Integration via API article.
Prerequisites
- Network access from the ESET PROTECT server to the Logsign collector on the syslog port you use (UDP or TCP 514 by default).
- An ESET PROTECT web console account with permission to change server settings and to create notifications.
Configure On ESET PROTECT
Unverified: the console menu names below have not been checked against a live ESET PROTECT console during this research and can differ between ESET PROTECT versions. Consult ESET's own documentation for your version if a menu is named differently.
ESET PROTECT can send two kinds of data to a syslog server, and Logsign parses both on the same source.
Event export. In the ESET PROTECT web console, open the server settings, enable the syslog server option and enter the IP address and port of your Logsign collector. Then enable exporting logs to syslog and choose JSON as the exported log format. Logsign parses the JSON export; CEF and LEEF exports from ESET PROTECT are not handled by the ESET parser, so keep the format on JSON.
Notifications. ESET PROTECT notifications (for example detection notifications or Event Log notifications for antivirus and firewall detections) can also be distributed over syslog. Create or edit the notification, and in its distribution settings enable sending it to syslog. The notification is delivered to the same syslog server configured in the server settings.
Both RFC 5424 and BSD (RFC 3164) syslog headers are accepted, so you do not need to change the syslog format ESET PROTECT uses. Notification text in English and Polish is recognized.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select ESET as the vendor, and Endpoint as the product.
| Field | Description |
|---|---|
| Host | IP address of the ESET PROTECT server sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once ESET PROTECT is forwarding syslog to the configured host and port, events should begin appearing under Search.
Log Format and Supported Events
The samples below illustrate the formats Logsign recognizes. They use placeholder host names and addresses and are not captured live data.
JSON event export (the event body is a JSON object after the syslog header):
1 2026-07-17T08:30:00.20Z protect.example.local ERAServer 940 - - {"event_type":"Threat_Event","hostname":"ws1.example.local", ...}Detection notification (BSD syslog header):
Sep 25 13:34:25 protect ERAServer[5420]: Detection type: Potentially unwanted application Detection name: MSIL/Microsoft.Bing.D Computer name: ws1.example.local Computer static group hierarchy: /All Logged user: WS1\admin Time of occurrence: 9/25/26, 1:32:51 PM UTC+3 Scanner: On-demand scanner Action performed: RetainedEvent Log notification for a firewall detection:
Sep 25 05:51:47 protect ERAServer[5420]: An Event Log notification has occurred with the following parameters: Category: Firewall detection Computer name: dns2 Computer static group hierarchy: /All Detection name: EsetIpBlacklist.B Source address: 203.0.113.10 Target address: 10.0.0.14 : 53For notifications, Logsign reads the labeled values in the message body and maps them as follows:
| Notification label | Logsign field |
|---|---|
| Detection type | Threat.Type |
| Detection name | Threat.Name |
| Computer name | Source.HostName |
| Logged user | Source.Username (built-in accounts such as NT AUTHORITY\SYSTEM are kept whole) |
| Scanner | Scan.Type |
| Action performed / Action taken | Event.Action |
| Category | Event.Category |
| Source address | Source.IP |
| Target address | Destination.IP and Destination.Port (a value such as 10.0.0.14 : 53 is split into address and port) |
The syslog host name is stored in EventSource.HostName and the program name (for example ERAServer) in Event.Prefix. Notifications are classified from their category first. Antivirus detections and detection notifications are classified as Security / Virus / Detect, and firewall detections as Security / Attack / Detect. Events that match none of the known categories fall back to System / Operation / Info.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search and check that fields such as Threat.Name, Source.HostName, Source.Username and Event.Action are populated for detection notifications.
- If notifications arrive but stay uncategorized, check that the notification body still contains the labels listed above (for example
Computer name:orDetection name:). A heavily customized notification template without these labels is not recognized as an ESET notification.