New features
EDR configuration now available in ESET PROTECT
EDR rules, exclusions, and blocked hashes can now be managed directly from ESET PROTECT. These capabilities have been migrated from ESET Inspect, providing a more unified management experience while preserving your existing workflows and security controls.
Note: We're releasing these features gradually throughout October 2026. Feature availability depends on your environment's internally assigned migration wave. Learn more—EDR Rules. Learn more—Exclusions. Learn more—Blocked hashes.
Terminal and file download
Live Terminal, available through the Remote Shell Access permission, provides remote access to Windows, Linux, and macOS devices directly from ESET PROTECT. You can run commands during an investigation and download files from a device by entering the file path. Access requires two-factor authentication. Available with an ESET PROTECT Enterprise subscription or higher. Learn more
Telemetry events
Search telemetry events directly in ESET PROTECT and drill down into individual events for low-level threat hunting. Learn more
Archive for indicators
We're introducing an archive for indicators with a longer retention period, so you can search them when investigating older activity. Learn more
Platform-wide ESET LiveAI
ESET LiveAI (formerly ESET AI Advisor) now delivers AI-powered assistance across the entire ESET PROTECT platform, enabling users to quickly find relevant information, interpret security data, and make informed decisions using insights from multiple ESET resources and domains. Learn more
New firewall integrations through the Broker Agent
ESET PROTECT can now collect and process data from supported Palo Alto Networks and Fortinet firewalls through the Broker Agent. This gives your security team more visibility during threat investigations. Learn more—Palo Alto. Learn more—Fortinet.
Notifications for integration status and usage limits
Get notified when a connected integration runs into problems or approaches its usage limit. Early visibility into integration health and consumption thresholds helps you identify potential disruptions sooner and keep your integrations working. Learn more
Exclusions from automatic enablement in Basic setup
You can now exclude specific devices and static groups from automatic enablement of selected platform modules. This lets you keep automatic enablement active across your environment while preventing the selected modules from being enabled or re-enabled on devices that need a custom configuration. Learn more
MDR threat report archive
Past MDR threat reports are now available under MDR Archive. Existing customers who already receive these reports can see every report released since January 1, 2026. New customers can see the most recent report released before they started using ESET MDR, along with any reports released since. Learn more
Simplified onboarding
New customers now get a simplified onboarding experience in ESET PROTECT. It brings recommended settings together in one place and reduces the effort needed to start protecting devices. Learn more
Default theme now follows your operating system
ESET PROTECT matches your operating system's light or dark setting by default. You can still pick a specific theme in settings. Learn more
Enhanced syslog forwarding
We've enhanced syslog forwarding with support for multiple syslog configurations and multitenant environments. You can now forward security events to different destinations and assign configurations to specific tenants. Syslog forwarding settings and existing configurations have been moved from the Settings section to the Integrations section in ESET PROTECT. Learn more
End of support for VMware Workspace ONE (Android) synchronization
Synchronization with VMware Workspace ONE (Android) is no longer supported. Android devices enrolled this way no longer connect to ESET PROTECT. To keep them managed and protected, enroll them using another Android enrollment method. Learn more
Other improvements and bug fixes
Find out what else has been improved in the changelog.