ESET Security

Monitor ESET protection modules, real-time protection, signature age and detections locally on Windows and macOS devices, without ESET PROTECT access.

The ESET Security check runs directly on the device, every 15 minutes by default. On Windows it reads ESET Endpoint or Server Security through eRmm.exe; on macOS it supports ESET Endpoint Security and Antivirus version 7 or later through ESET's local command-line tools. Linux is not supported. Everything it reports comes from the device. No ESET PROTECT cloud access or API credentials are involved.

Prerequisites

The device runs Windows or macOS.
The octoja agent is installed on the device and connected.
A supported ESET product is installed on the device. Its local query tools ship with the product, so nothing extra is installed for the check.
You need the Monitoring Check Management permission to add or edit checks.

You do not have to tell octoja where ESET lives. On Windows, the check looks for eRmm.exe in the configured path, under %ProgramFiles%\ESET, and in the registry. On macOS it searches for the ESET app bundle under /Applications. Only a non-standard location needs Path to ESET installation: the full path to eRmm.exe or the app bundle respectively.

Steps

Go to Devices and open the device.
Click the Checks tab → Add Check → ESET Security.
Keep the defaults, or adjust the thresholds described below.
Click Add Check.

To roll the check out to many devices at once, assign it through a config package instead — see Assign checks with config packages.

Settings

The last two fields only appear once you switch on Show advanced options.

Field	Type	Required	Default	Description
Maximum signature age (days)	Integer	No	1	Warns when the virus signature database is older than this many days.
Detection window (hours)	Integer	No	24	How far back the check reads ESET's threat log. Detections in this window are reported: unhandled ones as critical, ones ESET already cleaned as a warning.
Path to ESET installation	String	No	Found automatically	Full path to `eRmm.exe` on Windows or the ESET app bundle on macOS. Only needed for non-standard installation directories.
Query timeout (seconds)	Integer	No	60	Maximum time to wait for a local ESET query. Values below 10 are raised to 10.

Results

Field	What you see
Product and version	Which ESET product is installed and its version number, next to the device's host name.
Protection modules	Active when no core protection component is switched off, otherwise Disabled.
Real-time protection	Active or Inactive, based on the real-time and file-system protection states ESET reports.
Virus signatures	Current or Outdated, followed by the signature age in days.
Detections	None, Handled with the number of detections, Detected when something is still active, or Unknown when the threat log could not be read.
Recent detections	Up to ten entries from the detection window, each with its time, the threat name and the action ESET took. Unhandled entries are highlighted more strongly than handled ones.
Signature database	The date of the installed signature database and, in brackets, the scanner module version.
Firewall and network protection	Show whether ESET reports a disabled or paused protection feature. Such a report produces a Critical result.
Advisories	Additional ESET messages, such as HIPS, end-of-life or unreachable cloud services. The warning or critical severity reported by ESET contributes to the check result.

The check considers both ESET's overall status and its individual protection messages and reports the highest severity. Even unrecognized warning or error messages remain visible with their description or identifier. Green real-time protection alone therefore does not mean the whole check is healthy. For a warning or critical result, open the reported component in ESET and address its cause there.

Message	Result	What to do
ESET Security is not installed (eRmm.exe or ESET app bundle not found).	Critical	Install a supported ESET product, or enter the path to `eRmm.exe` (Windows) or the ESET app bundle (macOS) under Path to ESET installation if it sits outside the standard directory.
A core protection component is disabled: …	Critical	Re-enable the component named in the message in ESET on that device, or in the policy that manages it.
Real-time protection is disabled: …	Critical	Switch real-time or file-system protection back on. It is the single most important setting this check watches.
Unhandled detection: …	Critical	ESET found something it could not clean. Open the device and deal with the named threat.
ESET reports an active detection.	Critical	ESET's own protection status flags an active detection. Review the device in ESET.
… detection(s) in the window — all handled by ESET.	Warning	Nothing is left running, but the device saw activity worth a look. Widen or narrow the window with Detection window (hours).
Virus signatures are … day(s) old.	Warning	Let ESET update, or check why the device cannot reach ESET's update servers. Raise Maximum signature age (days) if the default of one day is too strict for you.
Signature age could not be determined.	Warning	ESET did not return a usable scanner module date. Verify the product is fully installed and up to date.

When the local query fails

If the check cannot get a usable answer from ESET's local tools, it reports a check failure and says why. It does not fall back to claiming that protection is off — an unanswered query is a collection problem, not a verdict on the device's security. The eRmm messages below apply to Windows.

Message	What it means
ESET did not respond in time — the eRmm query timed out.	The query ran longer than the query timeout. A busy scan or a slow server can cause this; raise Query timeout (seconds) if it repeats.
ESET's eRmm interface returned no data (…).	eRmm produced nothing. The exit code and any error text appear in brackets. Usually the ESET kernel service is not running.
ESET's eRmm interface returned an unexpected response (…).	eRmm answered, but not in the expected format. The first part of the answer appears in brackets. Contact support with that text if it persists.
ESET may be blocking access to its eRmm interface. …	The message recommends a real-time detection exclusion for the octoja program folder; the path appears there without backslashes and means `C:\Program Files\octoja GmbH`. First check the settings in Check ESET RMM access below. The empty result does not establish the cause.
Any other message	Something unexpected went wrong while the check ran. The device's own error text is shown as the message. Contact support with that text if it persists.

Check ESET RMM access (`application-info: empty result`)

On Windows, application-info: empty result may mean ESET is restricting queries through eRmm.exe. In the ESET policy for the affected device, check that ESET RMM is enabled. If ESET authorizes RMM by application path, open Allowed RMM application paths and add the full path to the installed Octo.Checks.Eset.exe. ESET expects executable paths here, not a general folder exclusion. The check's path includes a version number and may need updating after a check update. Run the check again and confirm it returns protection data. See ESET's RMM settings guide for details.

German ESET dialog “Zugelassene RMM-Anwendungspfade” showing paths to Octo.Tentacle.exe and Octo.Checks.Eset.exe and the “Speichern” (Save) button.

Example from the German ESET interface. Use the check path for the version installed on your device.

If ESET has quarantined an octoja file instead, that is a separate issue: investigate the detection and see Configure Antivirus Exclusions for the octoja Agent. A real-time detection exclusion does not replace RMM authorization.

If you used the ESET PROTECT integration before

The ESET card under Administration → Integrations is gone, and it no longer needs to be there. The check kept the same identity when it moved onto the device, so every assignment you already made — on individual devices and through config packages — keeps working automatically. There is nothing to reconnect, nothing to migrate and nothing to re-create. The visible differences are the name, now ESET Security, and the fact that results come from the device instead of the cloud.

ESET Security or Antivirus Status?

Both checks look at antivirus, but they are not the same thing and can run side by side. Antivirus Status is the vendor-neutral check: it reports installation, real-time protection and definition age for whatever antivirus product it finds — including ESET. On Windows clients it starts from what the Windows Security Center has registered; on Windows Server, where there is no Security Center, it probes the vendors it knows directly. ESET Security talks to ESET directly and therefore sees more: individual protection modules, the scanner module version, ESET's own advisories and the entries in ESET's threat log. Use ESET Security on devices where you know ESET is the product, and Antivirus Status where the vendor varies or you want one check across a mixed fleet.

FAQ

Why does the check report a protection error after an ESET license change?

For vulnerability_management.not_functional or patch_management.not_functional, compare the ESET policy with the features included in your license. An enabled but no longer licensed feature can report an error through eRmm.exe even while the ESET interface appears green. Disable only features you no longer use and no longer license; keep required protection modules enabled.

Was this helpful?

Still need help? Ask the team