read thedocs.

[ docs // guides & reference ]

Connector setup guides, tool references, auth flows, and platform concepts — everything you need to run StackJack, in one place.

Browse the Docs All Connectors
34 connectors documented // 6,712 tools referenced // setup, auth & platform guides
↓

No pages match that search. Clear it

← All documentation

ESET PROTECT Tools

eset_ · 102 tools · Free 51 · Pro 51 OAuth2 password grant with a rotating refresh token (cached access tokens, self-refresh on demand); NO single base URL — every op targets a per-domain host https://..eset.systems (region parsed from InstanceUrl); pageSize (cap 1000) + opaque pageToken cursor; raw JSON passthrough except the 2 quarantine download tools, which return SAS URLs to blob-stored binaries; 13 tools (9 quarantine + 3 user + eset_list_detections) are unavailable in the jpn region.

Executables

Tool Plan Access Description
eset_block_executable Pro Write [ESET PROTECT] Block an executable so it will not be executed on managed devices. Provide the executable UUID (from eset_list_executables). Idempotent — re-blocking an already-blocked executable is a no-op. Returns the raw ESET response JSON.
eset_get_executable Free Read-only [ESET PROTECT] Get details of a specific executable. Provide the executable UUID (from eset_list_executables). Returns the raw ESET executable JSON.
eset_list_executables Free Read-only [ESET PROTECT] List all executables observed across managed devices. Paginated via pageToken. Returns raw ESET JSON {executables:[...], nextPageToken}. Get a single executable's detail with eset_get_executable.
eset_unblock_executable Pro Write [ESET PROTECT] Unblock a previously blocked executable so it can run again. Provide the executable UUID (from eset_list_executables). Idempotent — unblocking an already-unblocked executable is a no-op. Returns the raw ESET response JSON.
eset_block_executable parameters
Param Type Required Default Description
executableUuid string yes Reference to the executable to be blocked (from eset_list_executables).
eset_get_executable parameters
Param Type Required Default Description
executableUuid string yes Reference to the executable whose details are requested (from eset_list_executables).
eset_list_executables parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
eset_unblock_executable parameters
Param Type Required Default Description
executableUuid string yes Reference to the executable to be unblocked (from eset_list_executables).

Groups (Asset Management)

Tool Plan Access Description
eset_create_group Pro Write [ESET PROTECT] Create a static group (folder) in the asset hierarchy and receive its assigned UUID. Body (fieldsJson) wraps a `group` object; set `group.displayName` (required) and optionally `group.parentGroupUuid` (parent group UUID from eset_list_device_groups; omit for the tree root) and `group.description`. Returns the created group JSON. The special 'All'/'Lost&Found' groups and entity-linked (CUSTOMER/MSP) groups cannot be created here.
eset_delete_group Pro Destructive [ESET PROTECT] Delete the group referenced by groupUuid AND every group and object beneath it — cascading and irreversible. Entity-linked (CUSTOMER/MSP) groups cannot be deleted. Group UUID from eset_list_device_groups.
eset_move_group Pro Destructive [ESET PROTECT] Move a group (and its subtree) under a different parent, reorganizing the MSP company/site tree and re-evaluating policy assignments along the new hierarchy — only within the same tenant. Body (fieldsJson): newParentUuid (the target parent group UUID). Group UUIDs from eset_list_device_groups.
eset_rename_group Pro Write [ESET PROTECT] Change a group's display name. Body (fieldsJson): displayName (the new name). Group UUID from eset_list_device_groups.
eset_create_group parameters
Param Type Required Default Description
fieldsJson string yes Group definition JSON wrapping a `group` object. Required: group.displayName. Optional: group.parentGroupUuid, group.description, group.externalReference.
eset_delete_group parameters
Param Type Required Default Description
groupUuid string yes UUID of the group to delete (root of the removed subtree). From eset_list_device_groups.
releaseConsumedUnits boolean no null If true, release the units/seats consumed by deleted devices so they can be reused. Optional.
eset_move_group parameters
Param Type Required Default Description
fieldsJson string yes JSON with newParentUuid: the target parent group UUID.
groupUuid string yes UUID of the group to move. From eset_list_device_groups.
eset_rename_group parameters
Param Type Required Default Description
fieldsJson string yes JSON with displayName: the new group display name.
groupUuid string yes UUID of the group to rename. From eset_list_device_groups.

Device Tasks (Automation)

Tool Plan Access Description
eset_create_device_task Pro Destructive [ESET PROTECT] Create a device task that runs an action (scan / isolation / uninstall / power action) on target endpoints. Body (fieldsJson) wraps a `task` object requiring: task.displayName, task.action, task.targets (device or device-group UUIDs), and at least one entry in task.triggers (else the call fails). Returns the created task JSON. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_delete_device_task Pro Destructive [ESET PROTECT] Delete a device task. Deleting a templated task deletes all tasks sharing its template. Irreversible. Task UUID from eset_list_device_tasks.
eset_get_device_task Free Read-only [ESET PROTECT] Get a single device task entity by UUID (its action, targets, and triggers). For per-device execution history call eset_list_device_task_runs. Task UUID from eset_list_device_tasks.
eset_list_device_task_runs Free Read-only [ESET PROTECT] List the run history (executions and results) of a device task, optionally scoped to one device or only the latest run per device. Paginated via pageToken. Task UUID from eset_list_device_tasks; device UUID from eset_list_devices.
eset_list_device_tasks Free Read-only [ESET PROTECT] List all device tasks (scheduled actions run on endpoints). Paginated via pageToken. Returns raw ESET JSON {tasks:[...], nextPageToken}. Task UUIDs feed eset_get_device_task and eset_list_device_task_runs.
eset_update_device_task_targets Pro Destructive [ESET PROTECT] Replace the targets (which devices / device groups the task runs on) of an existing device task — re-aiming an endpoint action. Body (fieldsJson): targets with devicesUuids and/or deviceGroupsUuids arrays. Task UUID from eset_list_device_tasks. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_update_device_task_triggers Pro Destructive [ESET PROTECT] Replace the trigger list (when the task runs) of an existing device task. The new triggers array cannot be empty. Body (fieldsJson): triggers array. Task UUID from eset_list_device_tasks. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_create_device_task parameters
Param Type Required Default Description
fieldsJson string yes Task definition JSON wrapping a `task` object. Required: task.displayName, task.action, task.targets, task.triggers (non-empty).
eset_delete_device_task parameters
Param Type Required Default Description
taskUuid string yes UUID of the device task to delete. From eset_list_device_tasks.
eset_get_device_task parameters
Param Type Required Default Description
taskUuid string yes UUID of the device task. From eset_list_device_tasks.
eset_list_device_task_runs parameters
Param Type Required Default Description
deviceUuid string no null Optional device UUID — include only runs on this device. From eset_list_devices.
listOnlyLastRuns boolean no null If true, return only the latest run per device.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
taskUuid string yes UUID of the device task whose runs to list (required). From eset_list_device_tasks.
eset_list_device_tasks parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
eset_update_device_task_targets parameters
Param Type Required Default Description
fieldsJson string yes JSON with a `targets` object: devicesUuids and/or deviceGroupsUuids arrays.
taskUuid string yes UUID of the device task to re-target. From eset_list_device_tasks.
eset_update_device_task_triggers parameters
Param Type Required Default Description
fieldsJson string yes JSON with a non-empty `triggers` array that replaces the current triggers.
taskUuid string yes UUID of the device task to re-trigger. From eset_list_device_tasks.

Device Groups

Tool Plan Access Description
eset_list_device_group_members Free Read-only [ESET PROTECT] List the devices that are members of a device group. Provide the device group UUID (from eset_list_device_groups). Set recurseSubgroups=true to also include devices from nested subgroups. Group membership is independent of the device entity itself. Paginated via pageToken. Returns raw ESET JSON.
eset_list_device_groups Free Read-only [ESET PROTECT] List all device groups. The group hierarchy can be reconstructed from the returned device_groups (each carries its parent reference). Paginated via pageToken. Returns raw ESET JSON {device_groups:[...], nextPageToken}. List the member devices of a group with eset_list_device_group_members.
eset_list_device_group_members parameters
Param Type Required Default Description
groupUuid string yes Reference to the device group whose members should be listed (from eset_list_device_groups).
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
recurseSubgroups boolean no null If true, also return devices from the group's subgroups, not just the requested group.
eset_list_device_groups parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.

Devices

Tool Plan Access Description
eset_batch_get_devices Free Read-only [ESET PROTECT] Retrieve a specific set of devices at a consistent point in time. Provide the device UUIDs (from eset_list_devices). The operation is atomic — either every requested device is returned or none. Returns raw ESET JSON.
eset_get_device Free Read-only [ESET PROTECT] Get the full details of a single device. Provide the device UUID (from eset_list_devices). Returns the raw ESET device JSON.
eset_import_devices Pro Write [ESET PROTECT] Import a batch of devices into device management (max 1000 per request). Imported devices cannot be managed until properly enrolled. Body (fieldsJson) requires a `devices` array (each with a unique `displayName`; set `isMobile`=true for MDM scenarios) and an optional `parentGroupUuid` (from eset_list_device_groups) applied to all imported devices. May return partial success (200 with per-device errors keyed by display name). May return a 202 cached-response envelope with a response-id for long-running requests. Returns raw ESET JSON.
eset_list_devices Free Read-only [ESET PROTECT] List all managed devices, optionally filtered. Paginated via pageToken. Returns raw ESET JSON {devices:[...], nextPageToken}. Use eset_get_device for a single device's full detail, or eset_batch_get_devices to fetch several at once.
eset_move_device Pro Write [ESET PROTECT] Move a device under a new parent group. Provide the device UUID (from eset_list_devices). Body (fieldsJson) requires: newParentUuid (target group, from eset_list_device_groups). Moves are limited to the same tenant; policy assignments update to the new hierarchy. Returns raw ESET JSON.
eset_rename_device Pro Write [ESET PROTECT] Update a device's display name. Provide the device UUID (from eset_list_devices). Body (fieldsJson) requires: displayName. The display name is objective — it changes for everyone requesting the device. Returns raw ESET JSON.
eset_batch_get_devices parameters
Param Type Required Default Description
devicesUuids array no null Identifiers of the devices to retrieve (from eset_list_devices). If empty, the API returns INVALID_ARGUMENT.
eset_get_device parameters
Param Type Required Default Description
deviceUuid string yes Reference to the device (from eset_list_devices).
eset_import_devices parameters
Param Type Required Default Description
fieldsJson string yes Import request JSON. Required: devices array (each device needs a mutually-unique displayName). Optional: parentGroupUuid applied to all imported devices.
eset_list_devices parameters
Param Type Required Default Description
displayNames array no null Exact-match display names to filter on. Only devices whose display name exactly matches one of these are returned. Omit for no display-name constraint.
functionalityStatus string no null Filter by functionality status: DEVICE_FUNCTIONALITY_STATUS_OK, DEVICE_FUNCTIONALITY_STATUS_ATTENTION_RECOMMENDED, or DEVICE_FUNCTIONALITY_STATUS_ATTENTION_REQUIRED. Omit to return devices regardless of status.
isMuted boolean no null If true, only muted devices are returned; if false, only unmuted. Omit to return devices regardless of mute state.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
eset_move_device parameters
Param Type Required Default Description
deviceUuid string yes Reference to the device to move (from eset_list_devices).
fieldsJson string yes Move request JSON. Required: newParentUuid (the target group, from eset_list_device_groups).
eset_rename_device parameters
Param Type Required Default Description
deviceUuid string yes Reference to the device to rename (from eset_list_devices).
fieldsJson string yes Rename request JSON. Required: displayName (the new display name).

IAM (Roles & Permissions)

Tool Plan Access Description
eset_assign_role Pro Write [ESET PROTECT] Assign a role to a subject over one or more scopes. Additive — existing roles are kept. Body (fieldsJson): subjectType, subjectReference, and role {roleName, scopes:[...]}. Role names from eset_list_role_assignments / eset_create_role. Returns the resulting assignment JSON.
eset_create_role Pro Write [ESET PROTECT] Create a custom role that bundles a set of permissions. Body (fieldsJson) wraps a `role` object: name (URL-safe, unique within the instance; alphanumeric/-/_ only), permissionNames (from eset_list_permissions), and optional displayName/description. Returns the created role JSON.
eset_delete_role Pro Destructive [ESET PROTECT] Delete a custom role by name. Irreversible; any subject currently holding it loses those permissions. Role names appear in eset_list_role_assignments.
eset_list_permissions Free Read-only [ESET PROTECT] List every permission the platform defines — the catalog you draw permissionNames from when creating a role with eset_create_role. Paginated via pageToken.
eset_list_role_assignments Free Read-only [ESET PROTECT] List role assignments — which subjects (users, devices, user groups, managed identities, services) hold which roles over which scopes. Filter by a single subject and/or subject type; leave filters empty to return everything visible to the caller. Paginated via pageToken.
eset_revoke_role Pro Destructive [ESET PROTECT] Remove a role from a subject over the given scopes. The subject keeps roles/scopes not named here. Body (fieldsJson): subjectType, subjectReference, and role {roleName, scopes:[...]}. Inspect current assignments with eset_list_role_assignments first.
eset_assign_role parameters
Param Type Required Default Description
fieldsJson string yes JSON with subjectType, subjectReference, and role {roleName, scopes}.
eset_create_role parameters
Param Type Required Default Description
fieldsJson string yes Role definition JSON wrapping a `role` object. Required: role.name, role.permissionNames. Optional: role.displayName, role.description.
eset_delete_role parameters
Param Type Required Default Description
roleName string yes Name of the role to delete.
eset_list_permissions parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
eset_list_role_assignments parameters
Param Type Required Default Description
includeNestedScopes boolean no null If true, also include roles inherited from nested scopes.
orderBy string no null Comma-separated list of fields to order by (snake_case or JSON field names).
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
subjectReference string no null Return only roles of this subject (e.g. a User UUID / JWT `sub`). Omit to return all subjects.
subjectType string no null Subject type filter: SUBJECT_TYPE_USER, SUBJECT_TYPE_DEVICE, SUBJECT_TYPE_USER_GROUP, SUBJECT_TYPE_MANAGED_IDENTITY, or SUBJECT_TYPE_SERVICE.
eset_revoke_role parameters
Param Type Required Default Description
fieldsJson string yes JSON with subjectType, subjectReference, and role {roleName, scopes} to remove.

Detections

Tool Plan Access Description
eset_batch_get_detections Free Read-only [ESET PROTECT] Batch-retrieve detections by UUID in one atomic call (all-or-nothing). Body (fieldsJson) requires: detectionUuids (array of detection UUIDs from eset_list_detections; keep to ~100 per call, hard cap 1000). Returns raw ESET JSON. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_get_detection Free Read-only [ESET PROTECT] Get a single detection by UUID (v2). Detection UUID from eset_list_detections. Returns the raw ESET detection JSON.
eset_get_detection_v1 Free Read-only [ESET PROTECT] Get a single detection by UUID (legacy v1 surface). Detection UUID from eset_list_detections_v1. Returns the raw ESET detection JSON.
eset_list_detections Free Read-only [ESET PROTECT] List detections (v2) matching the criteria, across device and ESET Cloud Office Protection sources. Optionally filter by cloud-office tenant and occurrence-time window. Paginated via pageToken. Returns raw ESET JSON {detections:[...], nextPageToken}. Not available in the Japan (jpn) region.
eset_list_detections_v1 Free Read-only [ESET PROTECT] List detections (legacy v1 surface) matching the criteria. Optionally filter by device and occurrence-time window. Paginated via pageToken. Returns raw ESET JSON {detections:[...], nextPageToken}. Prefer eset_list_detections (v2) unless you specifically need the v1 shape.
eset_resolve_detection Pro Write [ESET PROTECT] Mark a detection as resolved. Detection UUID from eset_list_detections / eset_get_detection. Body (fieldsJson) optional: note (arbitrary text explaining the resolution); pass for none. Returns the raw ESET JSON response.
eset_batch_get_detections parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required: detectionUuids (array of detection UUIDs from eset_list_detections). Recommended <=100 per call; hard cap 1000.
eset_get_detection parameters
Param Type Required Default Description
detectionUuid string yes Detection UUID from eset_list_detections.
eset_get_detection_v1 parameters
Param Type Required Default Description
detectionUuid string yes Detection UUID from eset_list_detections_v1.
eset_list_detections parameters
Param Type Required Default Description
cloudOfficeTenantUuid string no null Include only detections for this ESET Cloud Office Protection tenant (UUID). Leave null for device detections.
endTime string no null Include only detections that occurred before this time (exclusive). UTC or offset timestamp, e.g. 2024-10-30T12:00Z.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
startTime string no null Include only detections that occurred at or after this time (inclusive). UTC or offset timestamp, e.g. 2024-10-30T12:00Z.
eset_list_detections_v1 parameters
Param Type Required Default Description
deviceUuid string no null Include only detections that occurred on this device (UUID from eset_list_devices).
endTime string no null Include only detections that occurred before this time (exclusive). UTC or offset timestamp, e.g. 2024-10-30T12:00Z.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
startTime string no null Include only detections that occurred at or after this time (inclusive). UTC or offset timestamp, e.g. 2024-10-30T12:00Z.
eset_resolve_detection parameters
Param Type Required Default Description
detectionUuid string yes Detection UUID from eset_list_detections.
fieldsJson string yes JSON body. Optional: note (text explaining the resolution). Pass for no note.

Detection Groups

Tool Plan Access Description
eset_get_detection_group Free Read-only [ESET PROTECT] Get details about a single detection group by UUID. Detection-group UUID from eset_list_detection_groups / eset_search_detection_groups. Returns the raw ESET detection-group JSON.
eset_list_detection_groups Free Read-only [ESET PROTECT] List detection groups (detections deduplicated/grouped by signature) matching the criteria. Optionally filter by cloud-office tenant, device, and occurrence-time window. Paginated via pageToken. Returns raw ESET JSON {detectionGroups:[...], nextPageToken}.
eset_resolve_detection_group Pro Write [ESET PROTECT] Mark ALL detections in a group as resolved in one call. Detection-group UUID from eset_list_detection_groups. Body (fieldsJson) optional: note (text explaining the resolution); pass for none. Returns the raw ESET JSON response.
eset_search_detection_groups Free Read-only [ESET PROTECT] Search detection groups with a filter expression (richer than the plain list). Body (fieldsJson) optional: filter (e.g. "resolved eq 0" for unresolved; supports eq/ne/gt/ge/lt/le/and/or/() and dot-notation nested fields), returnTotalSize (bool). Pass to return all. Returns raw ESET JSON.
eset_get_detection_group parameters
Param Type Required Default Description
detectionGroupUuid string yes Detection-group UUID from eset_list_detection_groups.
eset_list_detection_groups parameters
Param Type Required Default Description
cloudOfficeTenantUuid string no null Include only groups for this ESET Cloud Office Protection tenant (UUID). Leave null for device detections.
deviceUuid string no null Include only groups whose detections occurred on this device (UUID from eset_list_devices).
endTime string no null Include only detections that occurred before this time (exclusive). UTC or offset timestamp, e.g. 2024-10-30T12:00Z.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
startTime string no null Include only detections that occurred at or after this time (inclusive). UTC or offset timestamp, e.g. 2024-10-30T12:00Z.
eset_resolve_detection_group parameters
Param Type Required Default Description
detectionGroupUuid string yes Detection-group UUID from eset_list_detection_groups.
fieldsJson string yes JSON body. Optional: note (text explaining the resolution). Pass for no note.
eset_search_detection_groups parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Optional: filter (ODdata-style expression, e.g. "resolved eq 0"), returnTotalSize (bool). Pass for no filter.

EDR Rules & Exclusions

Tool Plan Access Description
eset_create_edr_rule Pro Write [ESET PROTECT] Create an EDR (ESET Inspect) rule. Body (fieldsJson) requires: rule object with xmlDefinition (XML in ESET Inspect rule format; a valid definition is required); optional enabled, scopes. Returns the created rule JSON.
eset_create_edr_rule_exclusion Pro Write [ESET PROTECT] Create an EDR rule exclusion. Body (fieldsJson) requires: exclusion object with xmlDefinition (XML in ESET Inspect rule format, actions ignored); optional ruleUuids (EDR rules the exclusion applies to, from eset_list_edr_rules), enabled, scopes, note. Returns the created exclusion JSON.
eset_delete_edr_rule Pro Destructive [ESET PROTECT] Delete an EDR rule permanently. Rule UUID from eset_list_edr_rules. Returns the raw ESET JSON response.
eset_delete_edr_rule_exclusion Pro Destructive [ESET PROTECT] Delete an EDR rule exclusion permanently. Exclusion UUID from eset_list_edr_rule_exclusions. Returns the raw ESET JSON response.
eset_disable_edr_rule Pro Destructive [ESET PROTECT] Disable an EDR rule (stops it matching) without deleting it. Rule UUID from eset_list_edr_rules. No body required. Returns the raw ESET JSON response.
eset_enable_edr_rule Pro Write [ESET PROTECT] Enable an EDR rule so it is used for matching. Rule UUID from eset_list_edr_rules. No body required. Returns the raw ESET JSON response.
eset_get_edr_rule Free Read-only [ESET PROTECT] Get details of a single EDR rule by UUID. Rule UUID from eset_list_edr_rules. Returns the raw ESET rule JSON.
eset_get_edr_rule_exclusion Free Read-only [ESET PROTECT] Get details of a single EDR rule exclusion by UUID. Exclusion UUID from eset_list_edr_rule_exclusions. Returns the raw ESET exclusion JSON.
eset_list_edr_rule_exclusions Free Read-only [ESET PROTECT] List EDR rule exclusions (patches that suppress one or more EDR rules' actions) matching the criteria. Paginated via pageToken. Returns raw ESET JSON {edrRuleExclusions:[...], nextPageToken}.
eset_list_edr_rules Free Read-only [ESET PROTECT] List EDR (ESET Inspect) rules matching the criteria, optionally filtered by severity level. Paginated via pageToken. Returns raw ESET JSON {edrRules:[...], nextPageToken}.
eset_update_edr_rule_definition Pro Write [ESET PROTECT] Replace the XML definition of an existing EDR rule. Rule UUID from eset_list_edr_rules. Body (fieldsJson) requires: xmlDefinition (XML in ESET Inspect rule format; an invalid definition returns 400). Returns the raw ESET JSON response.
eset_update_edr_rule_exclusion_definition Pro Write [ESET PROTECT] Replace the XML definition of an existing EDR rule exclusion. Exclusion UUID from eset_list_edr_rule_exclusions. Body (fieldsJson) requires: xmlDefinition (XML in ESET Inspect rule format, actions ignored). Returns the raw ESET JSON response.
eset_create_edr_rule parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required: rule (object with xmlDefinition; optional enabled, scopes).
eset_create_edr_rule_exclusion parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required: exclusion (object with xmlDefinition; optional ruleUuids, enabled, scopes, note).
eset_delete_edr_rule parameters
Param Type Required Default Description
ruleUuid string yes EDR rule UUID from eset_list_edr_rules.
eset_delete_edr_rule_exclusion parameters
Param Type Required Default Description
exclusionUuid string yes EDR rule exclusion UUID from eset_list_edr_rule_exclusions.
eset_disable_edr_rule parameters
Param Type Required Default Description
ruleUuid string yes EDR rule UUID from eset_list_edr_rules.
eset_enable_edr_rule parameters
Param Type Required Default Description
ruleUuid string yes EDR rule UUID from eset_list_edr_rules.
eset_get_edr_rule parameters
Param Type Required Default Description
ruleUuid string yes EDR rule UUID from eset_list_edr_rules.
eset_get_edr_rule_exclusion parameters
Param Type Required Default Description
exclusionUuid string yes EDR rule exclusion UUID from eset_list_edr_rule_exclusions.
eset_list_edr_rule_exclusions parameters
Param Type Required Default Description
includeTotalSize boolean no null If true, include total_size in the response.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
eset_list_edr_rules parameters
Param Type Required Default Description
includeTotalSize boolean no null If true, include total_size in the response.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
severityLevel string no null Filter to one severity level. One of: SEVERITY_LEVEL_UNSPECIFIED, SEVERITY_LEVEL_DIAGNOSTIC, SEVERITY_LEVEL_INFORMATIONAL, SEVERITY_LEVEL_LOW, SEVERITY_LEVEL_MEDIUM, SEVERITY_LEVEL_HIGH.
eset_update_edr_rule_definition parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required: xmlDefinition (new XML definition of the rule).
ruleUuid string yes EDR rule UUID from eset_list_edr_rules.
eset_update_edr_rule_exclusion_definition parameters
Param Type Required Default Description
exclusionUuid string yes EDR rule exclusion UUID from eset_list_edr_rule_exclusions.
fieldsJson string yes JSON body. Required: xmlDefinition (new XML definition of the exclusion).

Incidents

Tool Plan Access Description
eset_close_incident Pro Write [ESET PROTECT] Close an incident. Incident UUID from eset_list_incidents. Body (fieldsJson) optional: closureReason (INCIDENT_RESOLVE_REASON_TRUE_POSITIVE / _FALSE_POSITIVE / _SUSPICIOUS / _UNSPECIFIED) and finalComment () describing how it was resolved; pass to close with no reason/comment. Returns the raw ESET JSON response.
eset_create_incident_comment Pro Write [ESET PROTECT] Add a comment to an incident. Incident UUID from eset_list_incidents. Body (fieldsJson) requires: comment object with text. Returns the created comment JSON.
eset_delete_incident_comment Pro Destructive [ESET PROTECT] Delete a comment from an incident permanently. Incident UUID from eset_list_incidents; comment UUID from eset_list_incident_comments. Returns the raw ESET JSON response.
eset_get_incident Free Read-only [ESET PROTECT] Get details of a single incident by UUID. Incident UUID from eset_list_incidents. Returns the raw ESET incident JSON.
eset_get_incident_comment Free Read-only [ESET PROTECT] Get a single incident comment by UUID. Incident UUID from eset_list_incidents; comment UUID from eset_list_incident_comments. Returns the raw ESET comment JSON.
eset_list_incident_comments Free Read-only [ESET PROTECT] List all comments on a single incident, ordered by create time. Incident UUID from eset_list_incidents. Returns raw ESET JSON with the incident's comments.
eset_list_incidents Free Read-only [ESET PROTECT] List incidents matching an optional filter, ordered by order_by. Paginated via pageToken. Returns raw ESET JSON {incidents:[...], nextPageToken}.
eset_reopen_incident Pro Write [ESET PROTECT] Reopen a non-Open incident (sets status back to Open; assignee unchanged; a prior closing comment becomes a normal comment). Incident UUID from eset_list_incidents. Body (fieldsJson) optional: comment (); pass for none. Returns the raw ESET JSON response.
eset_update_incident_attributes Pro Write [ESET PROTECT] Update chosen basic attributes of an incident. Incident UUID from eset_list_incidents. Body (fieldsJson): any of assigneeUuid (user UUID), displayName, description, severity (INCIDENT_SEVERITY_LEVEL_LOW/_MEDIUM/_HIGH/_UNSPECIFIED), plus updateMask listing the fields to change. Returns the raw ESET JSON response.
eset_update_incident_comment Pro Write [ESET PROTECT] Change the text of an existing incident comment. Incident UUID from eset_list_incidents; comment UUID from eset_list_incident_comments. Body (fieldsJson) requires: text (the new comment text). Returns the raw ESET JSON response.
eset_close_incident parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Optional: closureReason (enum), finalComment (). Pass for none.
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_create_incident_comment parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required: comment ().
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_delete_incident_comment parameters
Param Type Required Default Description
commentUuid string yes Comment UUID from eset_list_incident_comments.
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_get_incident parameters
Param Type Required Default Description
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_get_incident_comment parameters
Param Type Required Default Description
commentUuid string yes Comment UUID from eset_list_incident_comments.
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_list_incident_comments parameters
Param Type Required Default Description
incidentUuid string yes Incident UUID whose comments to list (from eset_list_incidents).
eset_list_incidents parameters
Param Type Required Default Description
filter string no null Optional filter (CEL/AIP-160 syntax), e.g. incident.assignee_uuid == "uuid" or displayName.contains("abc"). Time filters use timestamp("...").
orderBy string no null Comma-separated fields to sort by (lower_case_with_underscores); append " desc" for descending, e.g. "display_name, severity desc".
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
eset_reopen_incident parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Optional: comment (). Pass for none.
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_update_incident_attributes parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Optional fields: assigneeUuid, displayName, description, severity (enum), updateMask (fields to update).
incidentUuid string yes Incident UUID from eset_list_incidents.
eset_update_incident_comment parameters
Param Type Required Default Description
commentUuid string yes Comment UUID from eset_list_incident_comments.
fieldsJson string yes JSON body. Required: text (new comment text).
incidentUuid string yes Incident UUID from eset_list_incidents.

Installers

Tool Plan Access Description
eset_create_installer Pro Write [ESET PROTECT] Create a downloadable installer that drops components, activates products, and enrolls devices into a security group. Body (fieldsJson) wraps an `installer` object: displayName, operatingSystemFamilyId (1=Windows, 3=macOS), deviceEnrollment.securityGroupUuid, plus optional flags; requestedComponentIds may pin specific components. Returns the installer JSON with downloadUrl. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_delete_installer Pro Destructive [ESET PROTECT] Delete an installer by UUID, invalidating its download URL. Irreversible. Installer UUID from eset_list_installers.
eset_generate_installer Pro Write [ESET PROTECT] Generate an ad-hoc GPO/SCCM-compatible configuration file for deploying the security product via Group Policy or System Center Configuration Manager. The config is returned inline and not stored. Body (fieldsJson) optional: sendAnonymousDiagnosticData, deviceEnrollmentSettings.securityGroupUuid (target group from eset_list_device_groups). May return a 202 cached-response envelope with a response-id for long-running requests.
eset_get_installer Free Read-only [ESET PROTECT] Get details of one installer by UUID (download URL, expiry, activated products, installed components). Installer UUID from eset_list_installers.
eset_list_installers Free Read-only [ESET PROTECT] List the installers available to the caller (each carries a download URL and expiry). Optionally filter by usability. Paginated via pageToken. Installer UUIDs feed eset_get_installer and eset_delete_installer.
eset_create_installer parameters
Param Type Required Default Description
fieldsJson string yes Installer definition JSON wrapping an `installer` object (displayName, operatingSystemFamilyId, deviceEnrollment, ...) plus optional requestedComponentIds.
eset_delete_installer parameters
Param Type Required Default Description
installerUuid string yes UUID of the installer to delete. From eset_list_installers.
eset_generate_installer parameters
Param Type Required Default Description
fieldsJson string yes Generation options JSON. Optional: sendAnonymousDiagnosticData (bool), deviceEnrollmentSettings.securityGroupUuid.
eset_get_installer parameters
Param Type Required Default Description
installerUuid string yes UUID of the installer. From eset_list_installers.
eset_list_installers parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
usable boolean no null If true, return only usable installers; if false, only unusable; omit for all.

Mobile Devices

Tool Plan Access Description
eset_activate_product_mobile_devices Pro Write [ESET PROTECT] Create a product-activation task targeting a batch of mobile devices; the product is chosen automatically from each device's parent group. All devices must share the same parent device group and that group must have an available subscription. Body (fieldsJson): deviceUuids array (from eset_list_devices). Fails atomically (400/403/404). May return a 202 cached-response envelope with a response-id for long-running requests.
eset_get_mobile_device_enrollment_links Pro Write [ESET PROTECT] Generate enrollment links (valid on Android/iOS only) for a batch of up to 1000 mobile devices. Each device must be flagged mobile and not already enrolled, else the whole batch fails atomically (400/404). Body (fieldsJson): deviceUuids array (from eset_list_devices). Returns the generated links.
eset_activate_product_mobile_devices parameters
Param Type Required Default Description
fieldsJson string yes JSON with deviceUuids: array of mobile device UUIDs sharing one parent group. From eset_list_devices.
eset_get_mobile_device_enrollment_links parameters
Param Type Required Default Description
fieldsJson string yes JSON with deviceUuids: array of mobile (Android/iOS) device UUIDs, max 1000. From eset_list_devices.

Network Access Protection

Tool Plan Access Description
eset_get_network_access_rule Free Read-only [ESET PROTECT] Get details about a single IP set on a policy. Provide the policy UUID (from eset_list_policies) and the IP set UUID (from eset_list_network_access_rules). Returns the raw ESET IP-set JSON.
eset_list_network_access_rules Free Read-only [ESET PROTECT] List all IP sets defined on a policy. Provide the policy UUID (from eset_list_policies). Paginated via pageToken. Returns raw ESET JSON. Get a single IP set with eset_get_network_access_rule.
eset_update_network_access_rule Pro Write [ESET PROTECT] Update an IP set on a policy. Provide the policy UUID (from eset_list_policies) and the IP set UUID (from eset_list_network_access_rules). Body (fieldsJson) wraps the changes under an `ipSet` object; updatable attributes are displayName, description, and ipAddresses (CIDR/IPv4/IPv6, no uniqueness check). Read-only IP sets cannot be updated; for built-in IP sets only ipAddresses is updatable. Returns raw ESET JSON.
eset_get_network_access_rule parameters
Param Type Required Default Description
ipSetUuid string yes Reference to the IP set (from eset_list_network_access_rules).
policyUuid string yes Reference to the policy in which the IP set is defined (from eset_list_policies).
eset_list_network_access_rules parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
policyUuid string yes Reference to the policy whose IP sets are listed (from eset_list_policies).
eset_update_network_access_rule parameters
Param Type Required Default Description
fieldsJson string yes Update request JSON with an `ipSet` object. Updatable fields: displayName, description, ipAddresses.
ipSetUuid string yes Reference to the IP set to update (from eset_list_network_access_rules).
policyUuid string yes Reference to the policy in which the IP set is defined (from eset_list_policies).

Patch Management

Tool Plan Access Description
eset_get_patching_process_details Free Read-only [ESET PROTECT] List device patching-process details (history of patch attempts). History is pruned repeatedly; at least the previous 30 days are available. Filter by deviceUuid (from eset_list_devices), deviceGroupUuid (from eset_list_device_groups), and an optional time interval (timePeriodStartTime inclusive, timePeriodEndTime exclusive; RFC 3339 timestamps). Paginated via pageToken. Returns raw ESET JSON.
eset_list_device_patch_status Free Read-only [ESET PROTECT] List device patches (unpatched applications, packages, and operating systems). If the same patch is missing on multiple devices, each device/patch pair is a separate entry. Filter by deviceUuid (from eset_list_devices), deviceGroupUuid (from eset_list_device_groups), or patchType. Paginated via pageToken. Returns raw ESET JSON.
eset_list_recent_patching_processes Free Read-only [ESET PROTECT] List the patching details of all application patching attempts performed recently (within the last few days). The list may be empty if no patching has occurred recently; stale data is pruned over several days. Returns raw ESET JSON.
eset_get_patching_process_details parameters
Param Type Required Default Description
deviceGroupUuid string no null Reference to a device group to scope to (from eset_list_device_groups). Omit for all accessible devices.
deviceUuid string no null Reference to a single device to scope to (from eset_list_devices). Omit for all accessible devices.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
timePeriodEndTime string no null Exclusive end of the interval (RFC 3339 timestamp). Optional.
timePeriodStartTime string no null Inclusive start of the interval (RFC 3339 timestamp). Optional.
eset_list_device_patch_status parameters
Param Type Required Default Description
deviceGroupUuid string no null Reference to a device group to scope to; nested groups are included recursively (from eset_list_device_groups). Omit for any accessible device.
deviceUuid string no null Reference to a single device to scope to (from eset_list_devices). Omit for any accessible device.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
patchType string no null Filter by patch category: PATCH_TYPE_APPLICATION, PATCH_TYPE_OPERATING_SYSTEM, or PATCH_TYPE_PACKAGE. Omit for all categories.

Policies

Tool Plan Access Description
eset_create_policy Pro Write [ESET PROTECT] Create a policy carrying feature configurations. All included feature policies must be valid or the call returns 400. Body (fieldsJson) wraps a `policy` object: displayName, features array, optional description. Returns the created policy JSON. Assign it to targets with eset_create_policy_assignment.
eset_create_policy_assignment Pro Write [ESET PROTECT] Assign a policy to a target (device, device group, or subscription). New assignments are appended at the lowest rank; rank 1 has the highest priority and policies merge from rank 1 downward. Body (fieldsJson) wraps an `assignment` object: policyUuid and target. Returns the created assignment JSON.
eset_delete_policy Pro Destructive [ESET PROTECT] Delete a policy by UUID. Irreversible; built-in policies cannot be deleted. Policy UUID from eset_list_policies.
eset_delete_policy_assignment Pro Destructive [ESET PROTECT] Remove a policy assignment (unassign a policy from its target); remaining assignments on that target are reordered. Irreversible. Assignment UUID from eset_list_policy_assignments.
eset_get_policy Free Read-only [ESET PROTECT] Get one policy's details (its feature configurations) by UUID. Policy UUID from eset_list_policies.
eset_get_policy_assignment Free Read-only [ESET PROTECT] Get one policy assignment (policy, target, and rank) by UUID. Assignment UUID from eset_list_policy_assignments.
eset_list_policies Free Read-only [ESET PROTECT] List all policies visible to the caller. Paginated via pageToken. Policy UUIDs feed eset_get_policy, eset_delete_policy, and eset_create_policy_assignment.
eset_list_policy_assignments Free Read-only [ESET PROTECT] List policy assignments (which policies are applied to which targets, and at what rank). Filter by policy or by target device / device group / subscription. Paginated via pageToken. Assignment UUIDs feed eset_get_policy_assignment and eset_delete_policy_assignment.
eset_update_policy_assignment_ranking Pro Write [ESET PROTECT] Move a policy assignment to a new rank on its target (rank 1 = highest priority). Body (fieldsJson): rank (>= 1 and <= the target's assignment count, else 400/412). Other assignments are reordered around it. Assignment UUID from eset_list_policy_assignments.
eset_create_policy parameters
Param Type Required Default Description
fieldsJson string yes Policy definition JSON wrapping a `policy` object. Required: policy.displayName. Optional: policy.features, policy.description.
eset_create_policy_assignment parameters
Param Type Required Default Description
fieldsJson string yes Assignment JSON wrapping an `assignment` object: policyUuid and target {deviceUuid | deviceGroupUuid | subscriptionUuid}.
eset_delete_policy parameters
Param Type Required Default Description
policyUuid string yes UUID of the policy to delete. From eset_list_policies.
eset_delete_policy_assignment parameters
Param Type Required Default Description
assignmentUuid string yes UUID of the policy assignment to remove. From eset_list_policy_assignments.
eset_get_policy parameters
Param Type Required Default Description
policyUuid string yes UUID of the policy. From eset_list_policies.
eset_get_policy_assignment parameters
Param Type Required Default Description
assignmentUuid string yes UUID of the policy assignment. From eset_list_policy_assignments.
eset_list_policies parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
eset_list_policy_assignments parameters
Param Type Required Default Description
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
policyUuid string no null Filter to assignments of one policy UUID. Merged with policyUuids when both are set.
policyUuids array no null Filter to assignments of several policies at once: one or more policy UUIDs. For a single policy prefer the policyUuid parameter.
targetDeviceGroupUuid string no null Filter to assignments targeting this device group UUID. From eset_list_device_groups.
targetDeviceUuid string no null Filter to assignments targeting this device UUID. From eset_list_devices.
targetSubscriptionUuid string no null Filter to assignments targeting this subscription UUID.
eset_update_policy_assignment_ranking parameters
Param Type Required Default Description
assignmentUuid string yes UUID of the policy assignment to re-rank. From eset_list_policy_assignments.
fieldsJson string yes JSON with rank: the new 1-based rank (cannot exceed the target's number of assignments).

Quarantine

Tool Plan Access Description
eset_batch_delete_quarantined_objects Pro Destructive [ESET PROTECT] Permanently delete a batch of quarantined objects by UUID — irreversible. Body (fieldsJson): objectUuids array (from eset_list_quarantined_objects). Not available in the Japan (jpn) region. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_batch_download_quarantined_objects Pro Read-only [ESET PROTECT] Download a batch of quarantined objects (by UUID) as a ZIP archive. Body (fieldsJson): objectUuids array (from eset_list_quarantined_objects). Returns a short-lived read-only SAS URL to the archive — the payload is potentially malicious and is handled out-of-band, not inline. A slow (>30s) download returns a pending marker with an opaque ContinuationToken instead; retrieve the archive later by calling eset_resume_async with that token. Not available in the Japan (jpn) region.
eset_batch_restore_quarantined_objects Pro Destructive [ESET PROTECT] Restore a batch of quarantined objects (by UUID) to their original locations — re-releases potentially-malicious files onto endpoints. Body (fieldsJson): objectUuids array plus optional addToExclusions (exclude from future scanning). Not available in the Japan (jpn) region. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_count_quarantined_objects Free Read-only [ESET PROTECT] Count quarantined objects matching the filter (same filter fields as eset_list_quarantined_objects). Cheaper than listing when you only need totals. Not available in the Japan (jpn) region.
eset_download_quarantined_objects Pro Read-only [ESET PROTECT] Download quarantined objects matching a filter as a ZIP archive. Body (fieldsJson): a `filter` object (same fields as eset_list_quarantined_objects) plus optional excludedObjectUuids. Returns a short-lived read-only SAS URL to the archive — the payload is potentially malicious and is handled out-of-band, not inline. A slow (>30s) download returns a pending marker with an opaque ContinuationToken instead; retrieve the archive later by calling eset_resume_async with that token. Not available in the Japan (jpn) region.
eset_get_quarantined_object Free Read-only [ESET PROTECT] Get a single quarantined object by UUID. Object UUID from eset_list_quarantined_objects. Not available in the Japan (jpn) region.
eset_list_quarantined_objects Free Read-only [ESET PROTECT] List quarantined objects (files, email messages, email attachments) matching the filter. All filters combine with AND. Paginated via pageToken. Object UUIDs feed eset_get_quarantined_object and the batch restore/delete/download tools. Not available in the Japan (jpn) region.
eset_purge_quarantined_objects Pro Destructive [ESET PROTECT] Permanently delete every quarantined object matching a filter (criteria-based delete) — irreversible. Body (fieldsJson): a `filter` object (same fields as eset_list_quarantined_objects) plus optional excludedObjectUuids. Not available in the Japan (jpn) region. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_restore_quarantined_objects_by_filter Pro Destructive [ESET PROTECT] Restore every quarantined object matching a filter to its original location — re-releases potentially-malicious files onto endpoints. Body (fieldsJson): a `filter` object plus optional addToExclusions (exclude from future scanning) and excludedObjectUuids. Not available in the Japan (jpn) region. May return a 202 cached-response envelope with a response-id for long-running requests.
eset_batch_delete_quarantined_objects parameters
Param Type Required Default Description
fieldsJson string yes JSON with objectUuids: array of quarantined-object UUIDs to permanently delete. From eset_list_quarantined_objects.
eset_batch_download_quarantined_objects parameters
Param Type Required Default Description
fieldsJson string yes JSON with objectUuids: array of quarantined-object UUIDs to download. From eset_list_quarantined_objects.
eset_batch_restore_quarantined_objects parameters
Param Type Required Default Description
fieldsJson string yes JSON with objectUuids: array of UUIDs to restore, plus optional addToExclusions (bool). From eset_list_quarantined_objects.
eset_count_quarantined_objects parameters
Param Type Required Default Description
filterCloudOfficeTenantUuid string no null Filter: cloud office tenant UUID.
filterEmailInternetMessageId string no null Filter: email Message-ID (exact).
filterEmailRecipient string no null Filter: email recipient address.
filterEmailSender string no null Filter: email sender address.
filterEmailSubject string no null Filter: substring in the email subject.
filterFileName string no null Filter: quarantined file path suffix.
filterMsSharepointRootSiteUuid string no null Filter: Microsoft SharePoint root site UUID.
filterMsTeamsTeamUuid string no null Filter: Microsoft Teams team UUID.
filterObjectOrigin string no null Filter object origin: OBJECT_ORIGIN_MS_OFFICE365, OBJECT_ORIGIN_GOOGLE_WORKSPACE, or OBJECT_ORIGIN_DEVICE.
filterObjectType string no null Filter object type: QUARANTINED_OBJECT_TYPE_EMAIL_MESSAGE, QUARANTINED_OBJECT_TYPE_EMAIL_ATTACHMENT, or QUARANTINED_OBJECT_TYPE_FILE_ON_DRIVE.
filterQuarantineReason string no null Filter quarantine reason: QUARANTINE_REASON_MALWARE, _GRAYWARE, _PHISHING, _SPAM, _SENDER_SPOOFING, or _RULE.
filterQuarantineTimeEndTime string no null Filter: exclusive end of the quarantine-time interval (RFC 3339 timestamp).
filterQuarantineTimeStartTime string no null Filter: inclusive start of the quarantine-time interval (RFC 3339 timestamp).
filterUserUuid string no null Filter: owning user UUID (mailbox/drive owner).
eset_download_quarantined_objects parameters
Param Type Required Default Description
fieldsJson string yes JSON with a `filter` object (email/file/origin/reason/time filters) and optional excludedObjectUuids.
eset_get_quarantined_object parameters
Param Type Required Default Description
objectUuid string yes UUID of the quarantined object. From eset_list_quarantined_objects.
eset_list_quarantined_objects parameters
Param Type Required Default Description
filterCloudOfficeTenantUuid string no null Filter: cloud office tenant UUID.
filterEmailInternetMessageId string no null Filter: email Message-ID (exact).
filterEmailRecipient string no null Filter: email recipient address.
filterEmailSender string no null Filter: email sender address.
filterEmailSubject string no null Filter: substring in the email subject.
filterFileName string no null Filter: quarantined file path suffix.
filterMsSharepointRootSiteUuid string no null Filter: Microsoft SharePoint root site UUID.
filterMsTeamsTeamUuid string no null Filter: Microsoft Teams team UUID.
filterObjectOrigin string no null Filter object origin: OBJECT_ORIGIN_MS_OFFICE365, OBJECT_ORIGIN_GOOGLE_WORKSPACE, or OBJECT_ORIGIN_DEVICE.
filterObjectType string no null Filter object type: QUARANTINED_OBJECT_TYPE_EMAIL_MESSAGE, QUARANTINED_OBJECT_TYPE_EMAIL_ATTACHMENT, or QUARANTINED_OBJECT_TYPE_FILE_ON_DRIVE.
filterQuarantineReason string no null Filter quarantine reason: QUARANTINE_REASON_MALWARE, _GRAYWARE, _PHISHING, _SPAM, _SENDER_SPOOFING, or _RULE.
filterQuarantineTimeEndTime string no null Filter: exclusive end of the quarantine-time interval (RFC 3339 timestamp).
filterQuarantineTimeStartTime string no null Filter: inclusive start of the quarantine-time interval (RFC 3339 timestamp).
filterUserUuid string no null Filter: owning user UUID (mailbox/drive owner).
orderBy string no null Comma-separated list of fields to order by.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken.
eset_purge_quarantined_objects parameters
Param Type Required Default Description
fieldsJson string yes JSON with a `filter` object selecting objects to permanently delete, plus optional excludedObjectUuids.
eset_restore_quarantined_objects_by_filter parameters
Param Type Required Default Description
fieldsJson string yes JSON with a `filter` object selecting objects to restore, plus optional addToExclusions (bool) and excludedObjectUuids.

Users

Tool Plan Access Description
eset_batch_get_users Free Read-only [ESET PROTECT] Retrieve a specific set of users at a point in time (max 1000 per request). Body (fieldsJson) requires: usersUuids (array of user UUIDs, from eset_list_users). The operation is atomic — either every requested user is returned or none. Returns raw ESET JSON. Not available in the Japan (jpn) region.
eset_get_user Free Read-only [ESET PROTECT] Get the details of a single user by their unique identifier. Provide the user UUID (from eset_list_users). Returns the raw ESET user JSON. Not available in the Japan (jpn) region.
eset_list_users Free Read-only [ESET PROTECT] List users, optionally filtered by active-product, cloud-office, display name, email, protection status, or user group. Paginated via pageToken. Returns raw ESET JSON {users:[...], nextPageToken}. Get a single user with eset_get_user or several with eset_batch_get_users. Not available in the Japan (jpn) region.
eset_batch_get_users parameters
Param Type Required Default Description
fieldsJson string yes Request JSON. Required: usersUuids (array of user UUIDs to retrieve, from eset_list_users).
eset_get_user parameters
Param Type Required Default Description
userUuid string yes Reference to the user to retrieve (from eset_list_users).
eset_list_users parameters
Param Type Required Default Description
activeProductAutoActivated boolean no null If true, only users whose product was auto-activated (for their group or tenant) are returned.
activeProductAutoActivationDetailsBase string no null Auto-activation base filter: PRODUCT_AUTO_ACTIVATION_BASE_TENANT or PRODUCT_AUTO_ACTIVATION_BASE_USER_GROUP.
activeProductAutoActivationDetailsUserGroupUuid string no null User group reference for auto-activation; only meaningful when base is USER_GROUP.
activeProductId integer no null Identifier (numeric value) of the governed product resource.
activeProductName string no null Name of the governed product item (not the display name).
activeProductSubscriptionUuid string no null Reference to the subscription used for product activation.
activeProductUnitPoolUuid string no null Reference to the unit pool used for product activation.
cloudOfficeTenantReference string no null Exact-match filter on the user's cloud office tenant reference.
displayName string no null Partial-match filter on the user's display name.
email string no null Partial-match filter on the user's primary or proxy email address.
hasCloudOfficeMsLicense boolean no null If true, only users with an associated Microsoft cloud-office license; if false, only users without one.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
protectionStatus string no null Filter by protection status: PROTECTION_STATUS_UNPROTECTED, PROTECTION_STATUS_PENDING, PROTECTION_STATUS_PARTIALLY_PROTECTED, or PROTECTION_STATUS_FULLY_PROTECTED.
userGroupUuid string no null Filter by the user's group (from user-management). Omit for all groups.

Vulnerabilities

Tool Plan Access Description
eset_list_device_os_vulnerabilities Free Read-only [ESET PROTECT] List operating-system vulnerabilities for devices. On Linux, some core-package vulnerabilities (glibc, systemd, etc.) are reported both here and as package vulnerabilities. Filter by deviceUuid (from eset_list_devices) or deviceGroupUuid (from eset_list_device_groups). Paginated via pageToken. Returns raw ESET JSON.
eset_list_device_vulnerabilities Free Read-only [ESET PROTECT] List device vulnerabilities matching the criteria. Each vulnerability is a separate entry, so a device with multiple vulnerabilities is listed multiple times. Filter by deviceUuid (from eset_list_devices), deviceGroupUuid (from eset_list_device_groups, recursive), or vulnerabilityScope (VULNERABILITY_SCOPE_APPLICATION, VULNERABILITY_SCOPE_OPERATING_SYSTEM, VULNERABILITY_SCOPE_PACKAGE). Paginated via pageToken. Returns raw ESET JSON.
eset_list_recent_vulnerability_scans Free Read-only [ESET PROTECT] List the scan details of all vulnerability scans performed recently (within the last few days). The list may be empty if no scans have occurred recently; stale data is pruned over several days. Filter by deviceUuid (from eset_list_devices) or deviceGroupUuid (from eset_list_device_groups). Paginated via pageToken. Returns raw ESET JSON.
eset_list_vulnerable_devices Free Read-only [ESET PROTECT] List vulnerable devices matching the criteria. Even if a device has multiple vulnerabilities, it is listed only once. Filter by deviceGroupUuid (from eset_list_device_groups). Paginated via pageToken. Returns raw ESET JSON. Use eset_list_device_vulnerabilities for per-vulnerability detail.
eset_list_device_os_vulnerabilities parameters
Param Type Required Default Description
deviceGroupUuid string no null Reference to a device group to scope to (from eset_list_device_groups). Omit for any accessible device.
deviceUuid string no null Reference to the vulnerable device to scope to (from eset_list_devices). Omit for any accessible device.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
eset_list_device_vulnerabilities parameters
Param Type Required Default Description
deviceGroupUuid string no null Reference to a device group to scope to; nested groups are included recursively (from eset_list_device_groups). Omit for any accessible device.
deviceUuid string no null Reference to the device to scope to (from eset_list_devices). Omit for any accessible device.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
vulnerabilityScope string no null Filter by vulnerability scope: VULNERABILITY_SCOPE_APPLICATION, VULNERABILITY_SCOPE_OPERATING_SYSTEM, or VULNERABILITY_SCOPE_PACKAGE. Omit for any scope.
eset_list_recent_vulnerability_scans parameters
Param Type Required Default Description
deviceGroupUuid string no null Reference to a device group to scope to (from eset_list_device_groups). Omit for all accessible devices.
deviceUuid string no null Reference to the device to scope to (from eset_list_devices). Omit for all accessible devices.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.
eset_list_vulnerable_devices parameters
Param Type Required Default Description
deviceGroupUuid string no null Reference to a device group to scope to (from eset_list_device_groups). Omit for any accessible device.
pageSize integer no 50 Max results per page (1-1000, default 50).
pageToken string no null Opaque cursor from a previous response's nextPageToken. Omit for the first page.

Web Access Protection

Tool Plan Access Description
eset_list_web_address_rules Free Read-only [ESET PROTECT] List the web-address rules on a policy, optionally narrowed to rules that reference a given domain. Provide the policy UUID (from eset_list_policies); set includeDomain to filter to rules containing that domain. Returns raw ESET JSON. Replace a rule's domains with eset_update_web_address_rule.
eset_update_web_address_rule Pro Write [ESET PROTECT] Replace all domains inside a web-address rule. Provide the policy UUID (from eset_list_policies) and the address rule UUID (from eset_list_web_address_rules). Body (fieldsJson): urls (array of URLs or domains — only the domain part is extracted, and duplicates collapse to one) plus optional sourceName. This replaces the rule's entire domain list; adding even a single domain requires the whole policy to be validated. Returns raw ESET JSON.
eset_list_web_address_rules parameters
Param Type Required Default Description
includeDomain string no null Domain of interest — restricts the result to rules that contain this domain. Omit to list all rules.
policyUuid string yes Reference to the policy whose web-address rules are listed (from eset_list_policies).
eset_update_web_address_rule parameters
Param Type Required Default Description
addressRuleUuid string yes Reference to the web-address rule whose domains are replaced (from eset_list_web_address_rules).
fieldsJson string yes Update request JSON. Required: urls (array of URLs/domains to set). Optional: sourceName (e.g. the source filename).
policyUuid string yes Reference to the policy containing the rule (from eset_list_policies).

Async Continuation

Tool Plan Access Description
eset_resume_async Free Read-only [ESET PROTECT] Resume any ESET operation that returned a 202 pending marker. Pass the pending marker's ContinuationToken verbatim as continuationToken — that is the ONLY input required; do not construct or edit it. Returns the completed result (raw JSON, or a SAS URL for a quarantine download), or another pending marker if ESET is still processing (retry with the new token). The token is validated as authentic and is redeemed with the exact plan/permission/safety gates of the original tool; a forged, cross-tenant, or repointed token is refused.
eset_resume_async parameters
Param Type Required Default Description
continuationToken string yes The opaque ContinuationToken copied verbatim from a prior ESET 202 pending marker. This is a tamper-proof handle to the original request — pass it unchanged; it fully determines what is resumed.