˄˅

Monitoring Windows

Monitoring for Windows is available to NinjaOne users using the ESET DEM plugin for NinjaOne. When monitoring is set up correctly, you can view ESET Scan Logs, ESET Threat Logs and the ESET Product Protection Status in the Windows Event Log. The administrator determines the log monitoring frequency.

Transfer logs to Windows Event Log

The ESET Direct Endpoint Management plugin for NinjaOne requires a monitoring script to transfer the ESET Scan Logs, ESET Threat Logs, and ESET Product Protection Status to the Windows Event Log, which NinjaOne can use to set notifications.

To set up a monitoring script to transfer logs to the Windows Event Log, perform the following steps on your workstations and then on your servers:

1.In the ESET DEM plugin for NinjaOne console, click Administration > Policies > Agent Policies.

2.In the Agent Policies section, select the Windows policy.

ninjaone_agent_policies_01

3.In the next window, click Scheduled Automations > Add a Scheduled Automation.

4.Type the Name and a Description for the scheduled script.

5.In the Schedule drop-down menu, select Every. Select your desired frequency in the Occurs Every drop-down menu.

6.Click Add.

ninjaone_windows_transfer_logs_01

7.Select the ESET—Windows category from the drop-down menu and click the applicable script.

ninjaone_windows_script_01

8.In the next window, select System in the Run As drop-down menu.

9.Next to Preset Parameter, type: --monitor=threat.

10. Click Apply.

11. Click Add.

12. Click Save.

Note

Two-Factor Authentication may be required to save changes.

13. When saved, click Close to leave the Policy Editor.

14. Repeat steps 1–12 on the server machines. In step 2, select Windows server machines.

A monitoring script is created in NinjaOne for Windows.

Note

All workstations affected by this policy transfer the ESET logs to the Windows Event Log using the time interval you selected in step 5. Windows Event Log entries created by the plugin are visible under Applications and Services Logs\ESET2Ninja.

Conditions

The ESET Direct Endpoint Management plugin for NinjaOne can create notifications and corrective actions when a workstation meets a set of specified conditions.

Workstations before servers

To set up conditions for your Windows machines, perform the following steps on your workstations and then on your servers.

1.In the ESET DEM plugin for NinjaOne console, click Administration > Policies > Agent Policies.

2.In the Agent Policies section, select the Windows policy.

ninjaone_agent_policies_01

3.In the next window, click Conditions > Add a condition.

4.Click Add.

ninjaone_windows_conditions_01

5.Select the ESET—Windows category from the drop-down menu and click the applicable script.

ninjaone_windows_conditions_02

6.In the next window, select System in the Run As drop-down menu.

7.Leave the Preset Parameter drop-down menu blank.

8.Click Apply.

9.Click Select a condition.

ninjaone_windows_conditions_03

10. In the Condition drop-down menu, select the appropriate condition.

Note

In this example, the Windows Event condition is selected.

11. Next to Source, type the source for the condition. For example, "ESETError".

12. Next to Event IDs, type the IDs for the condition and press Enter to create each entry. For example, IDs "22220" through "22230".

13. Click Apply.

ninjaone_windows_conditions_04

14. Type the Name for the condition.

15. Select the Severity level and Priority for the condition.

16. In the Reset Interval drop-down menu, select the frequency for the condition to be met.

17. In the Notify Technicians drop-down menu, select Send notifications.

18. Click Add.

ninjaone_windows_conditions_05

19. Click Save.

Note

Two-Factor Authentication may be required to save changes.

20. When saved, click Close to leave the Policy Editor.

21. Repeat steps 1–19 on the server machines. In step 2, select Windows server machines.

The condition is created in NinjaOne for Windows.

Threat Detected

--monitor=threat: Will contain text “New Threat Alerts” if threat has been found.

Additionally, Windows event will be written: Level Error, Source ESETError, Event ID 22221

Protection Status

esetProtectionStatus Custom Field will get updated when the script runs.

Additionally any protection status issues will get reported to Windows Event Log: Level Error, Source ESETError, Event ID 22222

˄˅