Monitoring Windows

Monitoring for Windows is available to NinjaOne users using the ESET DEM plugin for NinjaOne. When monitoring is set up correctly, you can view ESET Scan Logs, ESET Threat Logs and the ESET Product Protection Status in the Windows Event Log. The administrator determines the log monitoring frequency.

Transfer logs to Windows Event Log

The ESET Direct Endpoint Management plugin for NinjaOne requires a monitoring script to transfer the ESET Scan Logs, ESET Threat Logs, and ESET Product Protection Status to the Windows Event Log, which NinjaOne can use to set notifications.

To set up a monitoring script to transfer logs to the Windows Event Log, perform the following steps on your workstations and then on your servers:

1.In the ESET DEM plugin for NinjaOne console, click Administration > Policies > Agent Policies.

2.In the Agent Policies section, select the Windows policy.

ninjaone_agent_policies_01

3.In the next window, click Scheduled Automations > Add a Scheduled Automation.

4.Type the Name and a Description for the scheduled script.

5.In the Schedule drop-down menu, select Every. Select your desired frequency in the Occurs Every drop-down menu.

6.Click Add.

ninjaone_windows_transfer_logs_01

7.Select the ESET—Windows category from the drop-down menu and click the applicable script.

ninjaone_windows_script_01

8.In the next window, select System in the Run As drop-down menu.

9.Next to Preset Parameter, type: --monitor=threat.

10. Click Apply.

11. Click Add.

12. Click Save.

Note

Two-Factor Authentication may be required to save changes.

13. When saved, click Close to leave the Policy Editor.

14. Repeat steps 1–12 on the server machines. In step 2, select Windows server machines.

A monitoring script is created in NinjaOne for Windows.

Note

All workstations affected by this policy transfer the ESET logs to the Windows Event Log using the time interval you selected in step 5. Windows Event Log entries created by the plugin are visible under Applications and Services Logs\ESET2Ninja.

Conditions

The ESET Direct Endpoint Management plugin for NinjaOne can create notifications and corrective actions when a workstation meets a set of specified conditions.

Workstations before servers

To set up conditions for your Windows machines, perform the following steps on your workstations and then on your servers.

1.In the ESET DEM plugin for NinjaOne console, click Administration > Policies > Agent Policies.

2.In the Agent Policies section, select the Windows policy.

ninjaone_agent_policies_01

3.In the next window, click Conditions > Add a condition.

4.Click Add.

ninjaone_windows_conditions_01

5.Select the ESET—Windows category from the drop-down menu and click the applicable script.

ninjaone_windows_conditions_02

6.In the next window, select System in the Run As drop-down menu.

7.Leave the Preset Parameter drop-down menu blank.

8.Click Apply.

9.Click Select a condition.

ninjaone_windows_conditions_03

10. In the Condition drop-down menu, select the appropriate condition.

Note

In this example, the Windows Event condition is selected.

11. Next to Source, type the source for the condition. For example, "ESETError".

12. Next to Event IDs, type the IDs for the condition and press Enter to create each entry. For example, IDs "22220" through "22230".

13. Click Apply.

ninjaone_windows_conditions_04

14. Type the Name for the condition.

15. Select the Severity level and Priority for the condition.

16. In the Reset Interval drop-down menu, select the frequency for the condition to be met.

17. In the Notify Technicians drop-down menu, select Send notifications.

18. Click Add.

ninjaone_windows_conditions_05

19. Click Save.

Note

Two-Factor Authentication may be required to save changes.

20. When saved, click Close to leave the Policy Editor.

21. Repeat steps 1–19 on the server machines. In step 2, select Windows server machines.

The condition is created in NinjaOne for Windows.

Threat Detected

--monitor=threat: Will contain text “New Threat Alerts” if threat has been found.

Additionally, Windows event will be written: Level Error, Source ESETError, Event ID 22221

Protection Status

esetProtectionStatus Custom Field will get updated when the script runs.

Additionally any protection status issues will get reported to Windows Event Log: Level Error, Source ESETError, Event ID 22222

Event Log ID description

Status related events:

Event ID	Severity	Subject
20	Information	Scan Log Event
11120	Warning	Scan Log Event
22220	Error	Scan Log Event
21	Information	Threat Log Event
11121	Warning	Threat Log Event
22221	Error	Threat Log Event
22	Information	Protection status
11122	Warning	Protection status
22222	Error	Protection status

Task Related Events:

Event ID	Severity	Subject
23	Information	Install
11123	Warning	Install
22223	Error	Install
24	Information	Uninstall
11124	Warning	Uninstall
22224	Error	Uninstall
25	Information	Activation
11125	Warning	Activation
22225	Error	Activation
26	Information	Deactivation
11126	Warning	Deactivation
22226	Error	Deactivation
27	Information	Configuration
11127	Warning	Configuration
22227	Error	Configuration
28	Information	Module Update
11128	Warning	Module Update
22228	Error	Module Update
30	Information	On-Demand Scan
11130	Warning	On-Demand Scan
22230	Error	On-Demand Scan

˄˅