ESET Enterprise Inspector

Endpoint Detection & Response (EDR) has grown rapidly as organizations seek evidence that existing controls (like Endpoint Protection Platforms and email/web gateways) have failed, and to determine whether systems were compromised and data exfiltrated. A key motivation is reducing Mean Time To Respond (MTTR), since attackers can remain undetected for months. EDR focuses on collecting and analyzing Indicators of Compromise (IOCs) such as malicious hashes, bad IPs/URLs, process/file mismatches, unusual port use, process injection, module load point modifications, and registry changes. Typical capabilities include endpoint agents, centralized logging and analytics, remote endpoint examination, incident response support, correlation and querying, memory analysis, activity recording/playback, and automated containment actions, often aided by ML/DL baselining to reduce false positives. EDR complements—not replaces—EPP within broader security architectures, and it requires skilled analysts and mature security operations.

ESET’s EDR offering, Enterprise Inspector, supports Windows endpoints/servers and macOS, with Linux planned. It uses endpoint sensors plus ML techniques and rules to identify suspicious behavior, centralizes logs to on-prem repositories (stored one month by default), and can function offline, though cloud reputation (LiveGrid) improves detection and lowers false positives. Investigators can access all endpoint event data, retain visibility even if an endpoint is destroyed, and request additional configuration snapshots. Data is enriched with global and enterprise-specific reputation context and integrates third-party intelligence sources; ESET also publishes threat intel via STIX/TAXII. Enterprise Inspector supports detection of APT-style lateral movement, spoofing, privilege escalation, PowerShell abuse, remote code execution attempts, and exfiltration, and can generate attribution theories with confidence levels. It offers extensive reporting, live querying, correlation, SysInspector snapshots, file integrity monitoring, MFT review, and UEFI scanning, plus SIEM/SOAR integration via connectors/APIs. Key gaps include lack of SAML federation and limited interoperability with IT ticketing, change management, and unified endpoint management tools.

• Targeted attacks account for 11% of cybersecurity breaches.
• Corporate espionage accounts for 13% of cybersecurity breaches.
• Malware is involved in 48% of attacks.
• Account takeovers are involved in 14% of attacks.
• ESET is headquartered in Bratislava, Slovakia.
• ESET currently serves 110 million users in 200 countries.
• ESET was the first anti-malware vendor to discover LoJax and remediate UEFI malware in 2016.
• Enterprise Inspector agents are available for Windows 10/8/7, Windows Server 2019/2016/2012/2008R2, and macOS X.
• Enterprise Inspector stores events for one month by default in on-premises repositories.
• Nearly 1,700 preconfigured reports are available in the ESET Security Management Center.

• “A main goal of EDR is often reducing the Mean Time To Respond (MTTR), given that many reports show that attackers can spend months inside organizations before being detected.”
• “EDR is not a substitute for EPP, but rather a component of many modern security architectures, alongside EPP, email/web gateways, Network Threat Detection & Response (NTDR), and even Distributed Threat Deception tools.”
• “The inclusion of ML technology does not obviate the need for trained security analysts.”
• “All Enterprise Inspector agents in a given organization send logs to on-premises repositories, where events are analyzed and stored for one month by default.”
• “Security Engineers (SEs) thus have access not only to the data that ESET’s EEI evaluated as relevant to the case, but to all event data from the organizations‘ endpoints.”
• “Enterprise Inspector can also generate attribution theories with confidence levels.”
• “Natural language querying is not supported due to the perceived inaccuracies in results.”
• “Enterprise Inspector does not perform automatic rollback to last known good state.”
• “ESET is the only vendor that supports UEFI scanning.”
• “We recommend adding support for SAML federation for administrative users of the cloud-based enterprise console.”