Rogue Detection using ESET Protect (cloud)

[Sean_TER 1]

Sorry if these are newbie questions, 2nd day using this product...

I'm trying to use Rogue Detection to find all the computers on my network, but it doesn't seem to work at all. Everything I search for online seems to reference "On-Prem", and all the help pages seem to also reference this. I've tried to follow https://help.eset.com/protect_admin/10.0/en-US/fs_using_rd_sensor.html  (again it seems to be talking about "on-prem".). and this page, https://help.eset.com/protect_admin/10.0/en-US/admin_pol_rd_sensor.html?admin_pol_rd_sensor.html   I've created a policy as there wasn't one, yet it does nothing. 

Maybe I don't fully understand these products, but isn't the point of the ESET Protect (cloud), so you don't have to install a "server" locally etc. yet many things don't seem to work just using the cloud console. Here is a photo of the "RD report"  I'm concerned that it has "Server Name" at the top.  Does ESET Protect require "On-prem" AND Cloud console??  

 

thanks

Sean

[Sean_TER 1]

kinda gone down a rabbit hole here...

was able to install the RD Sensor, after having to install an outdated version of WinPcap. (??)

still doesn't work.. find out I need the agent installed as well..  https://help.eset.com/protect_cloud/en-US/component_installation_rd_sensor_windows.html

Installed the agent, or trying to, but it wants the location of a "server" I'm guessing an "On-prem" protect instance??  So once again we're back to "on-prem" being required to use the Cloud Console..     https://help.eset.com/protect_install/90/en-US/arch_agent.html?component_installation_agent_windows.html
then there is this... 
 

6.Select one of the following installation options and follow the steps from the appropriate section below:

•Server assisted installation - You will need to provide ESET PROTECT Web Console administrator credentials. The installer will download the required certificates automatically.

You cannot use a user with two-factor authentication for server-assisted installations.

 

So at this point I'm stuck and it seems that "on-prem" is required. Or am I understanding all this incorrectly? How do I continue the Agent install process using "cloud console"? put the URL of my console as 'server host' ?  /boggle

 

[Sean_TER 1]

finally gotten this working.. there is an option to create a live installer w/ just the agent.  You all might consider redoing the online documentation on these products as it is quite mixed up between On prem and Cloud, and difficult to follow, but thanks for following along.. 🤷‍♂️

[MartinK 383]

19 hours ago, Sean_TER said:

finally gotten this working.. there is an option to create a live installer w/ just the agent.  You all might consider redoing the online documentation on these products as it is quite mixed up between On prem and Cloud, and difficult to follow, but thanks for following along.. 🤷‍♂️

Thanks for pointing out that inconsistency and documentation expectst that this component is being deployed on already managed device (= device with ESET Management Agent and possibly other ESET components installed).
Unfortunately support for this component in the cloud is little more limited in comparison to on-prem solutions, just because alternatives are being analyzed -> as you pointed out, this components is outdated as of now and relies on legacy library versions.

[j-gray 37]

On 7/10/2024 at 2:11 PM, Sean_TER said:

was able to install the RD Sensor, after having to install an outdated version of WinPcap. (??)

This has been a beef of mine for quite some time. WinPcap was last updated 11 years ago and has long been deprecated.

Given the fact that RDS needs to be installed on every single subnet, it's just not a viable option (we have 16 sites, each with at least three subnets and many without Windows or Linux hosts).

Most competing solutions have this functionality built into the agent. I really with ESET would provide a modern solution for this.