Monitor ESET PROTECT with Crowswatch

The ESET console tells you what your estate looks like right now. Crowswatch tells you what changed since yesterday, which is the part the console cannot do.

• Coverage: devices that have stopped checking in, and devices that have gone quiet but not yet gone dark
• Endpoint state: devices ESET reports as requiring attention
• Protection versions: devices running a version behind the norm for their own platform
• Estate shape: the managed device count falling against its own recent baseline, which usually means agents were removed
• Credential health: warning before the API user password expires, rather than after the connection has already broken

Everything is grouped. Ten devices going quiet at once is one alert about your estate, not ten alerts about ten laptops.

ESET expires API user passwords and provides no way to switch that off. The maximum is 365 days and the default for a newly created user is 90 days. When it lapses the credential stops working and Crowswatch stops seeing your estate.

This is normal ESET behaviour rather than a fault, so it is worth setting up deliberately instead of discovering it in a year.

• When you create the API user, set its password expiry to 365 days, the maximum ESET allows
• Tell Crowswatch the same window on the connect form, so it knows when to warn you
• Crowswatch warns at 14 days and again at 3 days before expiry, through your alert channels and on the integration page

To renew, before or after it lapses:

1. Reset the API user password in ESET Business Account, setting the expiry to 365 days again
2. Open Crowswatch → Integrations → ESET PROTECT
3. Enter the new password and confirm the expiry window

Nothing else changes. Your device register, history and thresholds survive a password renewal, and syncing resumes on the next run.

ESET requires a separate user account for API access. You cannot use your own login, and the account that creates it cannot be the account that uses it.

1. Sign in to ESET Business Account, ESET MSP Administrator 2 or ESET PROTECT Hub as a Root or Superuser
2. Create a new user for Crowswatch, for example crowswatch-api@yourdomain.com
3. Set its password expiry to 365 days, as covered above

ESET documents the process at help.eset.com.

Two settings on the new user. Both are required, and missing either produces a connection that signs in successfully and then shows you nothing.

1. Under Access Rights, switch on the Integrations toggle. Without it the credential authenticates against the portal and every API call is refused
2. Set Company access to Read
3. Set ESET PROTECT access to Read, covering all device groups rather than a single static group

Read is all Crowswatch needs and all it will ever use. Granting more does not enable anything.

Go to Crowswatch → Integrations → ESET PROTECT.

Crowswatch checks the credential with ESET before saving it, so a wrong password or a missing Integrations toggle fails here with the specific thing to fix rather than silently later.

The first sync walks your whole estate and establishes a baseline. It raises no alerts. Day one state is normal state, and Crowswatch only tells you about what changes after that.

Every threshold below is a default you can change. They are set conservatively and quietly on purpose.

Version comparison is per component per platform, not across your whole estate. A Mac running the macOS build of ESET Endpoint Security is compared against your other Macs, never against your Windows fleet, because those products are on unrelated version lines. A platform with too few devices for a norm to mean anything is skipped rather than guessed at.

Crowswatch treats the two failure cases separately because they need different things from you.

• 401 on the token request: the password is wrong, has expired, or the API user has been removed or disabled. This is the check Crowswatch uses to judge whether your credential is alive, because it is the only one that can tell a revoked account from an ESET outage
• 403 on a data request: the credential is valid and ESET is refusing the data. Almost always the Integrations toggle being off, or ESET PROTECT access not set to Read across all groups

One consequence worth knowing: ESET documents that when an administrator removes an API user, existing tokens keep working until they expire, up to an hour. Crowswatch judges credential health on requesting a fresh token rather than on data calls, so a revocation surfaces within that hour rather than looking healthy until something else breaks.

ESET publishes no rate limits, and none were observed at any concurrency during testing: no 429s, no rate-limit headers. The real constraint is throughput rather than quota.

• Requests are served at roughly 1.6 per second regardless of how many run at once, because ESET serialises rather than rejects
• A 1,770 device estate takes about 19 seconds to walk, across 10 pages
• Running requests in parallel does not make it faster

Crowswatch syncs every 30 minutes. Every threshold above is measured in hours and requires a change to persist across consecutive syncs, so a shorter cadence would cost throughput without telling you anything sooner. A large estate that cannot be walked in one run resumes where it left off, and no alert is raised from a partial view.

• The API user password is a credential, and is treated as one. It is encrypted at rest, decrypted only server-side at the moment of use, never written to logs or error messages, and never returned to your browser after saving
• Read-only is enforced in code, not by policy. The HTTP client accepts no method other than GET, so no code path can issue a write to an ESET data host
• Crowswatch reaches only ESET PROTECT device and incident hosts. The automation host, which is where network isolation, shutdown, process kill and agent uninstall live, is not in the allow-list and cannot be reached
• One ESET credential can reach PROTECT, Cloud Office Security and ESET Inspect. Crowswatch restricts itself to PROTECT
• Device records are narrowed before storage. IP addresses, device tokens, owner identifiers and hardware profiles are discarded rather than kept
• You can revoke access at any time by disabling the API user in ESET