Advanced AI Driven Cybersecurity at your fingertip | ESET


Endpoint Detection & Response (EDR) is a sophisticated tool for identification of anomalous behavior and breaches, risk assessment, incident response, investigations and remediation.

ESET Enterprise Inspector

Outstanding visibility and synchronized remediation with ESET EDR


Increased visibility

Early detection of clandestine insider threats, phishing or other attacks commonly used against enterprises.

Improved risk management

ESET Enterprise Inspector analyzes vast amounts of data in real-time to reduce response time, remediate security issues and improve security posture.

Answer to Advanced Persistent Threats (APT)

Ideal for threat hunting, ESET Enterprise Inspector proactively prevents future attacks, including insidious APTs.

ESET Enterprise Inspector Solution

Endpoint Detection and Response tool from ESET that enables continuous comprehensive monitoring of real-time endpoint activity, in-depth analysis of suspicious processes and immediate response to incidents and breaches. Paired with ESET Endpoint Protection Platform, ESET Enterprise Inspector is a complete prevention, detection and remediation solution to:

  • Detect advanced persistent threats
  • Stop fileless attacks
  • Block zero-day threats
  • Protect against ransomware
  • Prevent company policy violation
EDR Features
Public API

ESET Enterprise Inspector features an API that enables accessing and exporting of detections and their remediation to allow effective integration with tools such as SIEM, SOAR, ticketing tools and many others.

Remote access

ESET Enterprise Inspector features remote PowerShell capabilities that allow Security Engineers to remotely inspect and configure their organization’s computers, so a sophisticated response can be achieved without breaking the user’s workflow.

One-click isolation

Define network access policies to quickly stop malware’s lateral movements. Isolate a compromised device from the network by just one click in the ESET Enterprise Inspector interface. Also, easily remove the devices from the containment state.


ESET Enterprise Inspector references its detections to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) framework, which in one click provides you with comprehensive information even about the most complex threats.

Anomaly and behavior detection

Check actions carried out by an executable and utilize ESET’s LiveGrid® Reputation system to quickly assess if executed processes are safe or suspicious. Monitoring anomalous user-related incidents are possible due to specific rules written to be triggered by behavior, not simple malware or signature detections. Grouping of computers by user or department allows security teams to identify if the user is entitled to perform a specific action or not.


Assign and unassign tags for fast filtering to EEI objects such as computers, alarms, exclusions, tasks, executables, processes and scripts. Tags are shared among users, and once created, they can be assigned within seconds.

Multiple Indicators of compromise

View and block modules based on over 30 different indicators, including hash, registry modifications, file modifications and network connections.

Multiplatform coverage

ESET Enterprise Inspector supports Windows and macOS, which makes it a perfect choice for multiplatform environments.

Threat Hunting

Apply data filters to sort it based on file popularity, reputation, digital signature, behavior or contextual information. Setting up multiple filters allows automated, easy threat hunting, including APTs and targeted attacks, which is customizable to each company’s environment. By adjusting behavior rules, ESET Enterprise Inspector can also be customized for Historic Threat Hunting and “rescan” the entire events database.

Open architecture and integrations

ESET Enterprise Inspector provides a unique behavior and reputation-based detection that is fully transparent to security teams. All rules are easily editable via XML to allow fine-tuning or easily created to match the needs of specific enterprise environments, including SIEM integrations.

Company Policy Violation Detection

Block malicious modules from being executed on any computer in your organization’s network. ESET Enterprise Inspector’s open architecture offers the flexibility to detect violations of policies about using specific software like torrent applications, cloud storage, tor browsing or other unwanted software.

Investigation and Remediation

Use a built-in set of rules or create your own rules to respond to detected incidents. Each triggered alarm features a proposed next step to be performed for remediation. This quick response functionality helps to ensure that any single incident will not fall through the cracks.

Data collection

View comprehensive data about a newly executed module, including time of execution, user who executed, dwell time and attacked devices. All data is locally stored to prevent sensitive data leakage.


Prioritize the severity of alarms with scoring functionality that attributes a severity value to incidents and allows the admin to quickly identify computers with a higher probability of a potential incident.