Monitor ESET protection with the ESET Security check

The ESET Security check runs on the device and reads ESET Endpoint or Server Security locally — no cloud access, no credentials, no customer matching.

Written By Stefan Steuer

Last updated 8 days ago

The ESET Security check runs directly on the device. It reads the ESET product installed there — ESET Endpoint Security, ESET Endpoint Antivirus, ESET Server Security or ESET File Security — through eRmm.exe, the local management interface that ESET installs alongside the product. Everything the check reports comes from the machine itself: which protection modules are active, how old the virus signatures are, and what ESET has recently detected. No ESET PROTECT cloud console, no API credentials, no region and no customer-to-group matching are involved.

If you used the ESET PROTECT integration before

The ESET card under Administration → Integrations is gone, and it no longer needs to be there. The check kept the same identity when it moved onto the device, so every assignment you already made — on individual devices and through config packages — keeps working automatically. There is nothing to reconnect, nothing to migrate and nothing to re-create. The visible differences are the name, now ESET Security, and the fact that results come from the device instead of the cloud.

Prerequisites

The device runs Windows. This check is Windows-only; on any other operating system it reports the failure "This check runs only on Windows."
The octoja agent is installed on the device and connected.
An ESET endpoint or server product is installed on the device. The eRmm interface ships with that product, so nothing extra is installed for the check.
You need the Monitoring Check Management permission to add or edit checks.

You do not have to tell octoja where ESET lives. The check looks for eRmm.exe in three places, in this order: the path you entered under Path to eRmm.exe, then every product folder inside %ProgramFiles%\ESET, and finally the installation directory that ESET records in the Windows registry. Only a non-standard installation directory needs the manual path.

Add the check to a device

Go to Devices and open the device.
Click the Checks tab → Add Check → ESET Security.
Keep the defaults, or adjust the thresholds described below.
Click Add Check.

To roll the check out to many devices at once, assign it through a config package instead — see Assign checks with config packages. The check runs every 15 minutes by default.

Configuration options

The last two fields only appear once you switch on Show advanced options.

Field	Default	What it does
Maximum signature age (days)	1	Warns when the virus signature database is older than this many days.
Detection window (hours)	24	How far back the check reads ESET's threat log. Detections in this window are reported: unhandled ones as critical, ones ESET already cleaned as a warning.
Path to eRmm.exe	Found automatically	Full path to ESET's eRmm.exe. Only needed for non-standard installation directories.
Query timeout (seconds)	60	Maximum time to wait for each local eRmm query to complete. Values below 10 are raised to 10.

What the check reports

Field	What you see
Product and version	Which ESET product is installed and its version number, next to the device's host name.
Protection modules	Active when no core protection component is switched off, otherwise Disabled.
Real-time protection	Active or Inactive, based on the real-time and file-system protection states ESET reports.
Virus signatures	Current or Outdated, followed by the signature age in days.
Detections	None, Handled with the number of detections, Detected when something is still active, or Unknown when the threat log could not be read.
Recent detections	Up to ten entries from the detection window, each with its time, the threat name and the action ESET took. Unhandled entries are highlighted more strongly than handled ones.
Signature database	The date of the installed signature database and, in brackets, the scanner module version.
Advisories	Extra notes ESET raises: HIPS is disabled, Program version is reaching end of life and ESET cloud services unreachable. They are informational and do not change the check result on their own.

What the statuses mean

Message	Result	What to do
ESET Security is not installed (eRmm.exe not found).	Critical	Install an ESET endpoint or server product, or enter the path under Path to eRmm.exe if it sits outside the standard directory.
A core protection component is disabled: …	Critical	Re-enable the component named in the message in ESET on that device, or in the policy that manages it.
Real-time protection is disabled: …	Critical	Switch real-time or file-system protection back on. It is the single most important setting this check watches.
Unhandled detection: …	Critical	ESET found something it could not clean. Open the device and deal with the named threat.
ESET reports an active detection.	Critical	ESET's own protection status flags an active detection. Review the device in ESET.
… detection(s) in the window — all handled by ESET.	Warning	Nothing is left running, but the device saw activity worth a look. Widen or narrow the window with Detection window (hours).
Virus signatures are … day(s) old.	Warning	Let ESET update, or check why the device cannot reach ESET's update servers. Raise Maximum signature age (days) if the default of one day is too strict for you.
Signature age could not be determined.	Warning	ESET did not return a usable scanner module date. Verify the product is fully installed and up to date.

When the local query fails

If the check cannot get a usable answer out of eRmm, it reports a check failure and says why. It does not fall back to claiming that protection is off — an unanswered query is a collection problem, not a verdict on the device's security.

Message	What it means
ESET did not respond in time — the eRmm query timed out.	The query ran longer than the query timeout. A busy scan or a slow server can cause this; raise Query timeout (seconds) if it repeats.
ESET's eRmm interface returned no data (…).	eRmm produced nothing. The exit code and any error text appear in brackets. Usually the ESET kernel service is not running.
ESET's eRmm interface returned an unexpected response (…).	eRmm answered, but not in the expected format. The first part of the answer appears in brackets. Contact support with that text if it persists.
This check runs only on Windows.	The check was assigned to a Linux or macOS device. Remove it there, or narrow the config package rule to Windows.

ESET Security or Antivirus Status?

Both checks look at antivirus, but they are not the same thing and can run side by side. Antivirus Status is the vendor-neutral check: it asks the Windows Security Center which antivirus product is registered and reports installation, real-time protection and definition age for whatever it finds — including ESET. ESET Security talks to ESET directly and therefore sees more: individual protection modules, the scanner module version, ESET's own advisories and the entries in ESET's threat log. Use ESET Security on devices where you know ESET is the product, and Antivirus Status where the vendor varies or you want one check across a mixed fleet.