Best Practices for Service Providers in WatchGuard Cloud

When you log in to WatchGuard Cloud with your Service Provider account, you see your own Subscriber overview account, which is where you can manage your internal network devices, products and services, and review reports.

Account Manager, located in the left pane of the WatchGuard Cloud window, provides a unified view of the Service Provider and Subscriber accounts you manage. Service Provider accounts include a icon and Subscriber accounts include a icon.

To view your own Subscriber account, from Account Manager, select My Account.

You can also select the Subscriber view of any other managed account in Account Manager.

For more information about how to use Account Manager to manage your accounts, go to About WatchGuard Cloud Account Manager (Service Providers).

As a Service Provider in WatchGuard Cloud, you use Account Manager to navigate between your managed Service Provider and Subscriber accounts.

Account Manager enables Service Providers to make changes to devices or user-based services across multiple accounts. For example, Service Provider accounts can upgrade Fireboxes across multiple accounts without the need to navigate to each account separately. Service Providers can review notifications, audit logs, and account-level settings for a managed account without the need to switch to the Subscriber view of the account.

Multi-Tier Management

WatchGuard Cloud is a multi-tenant, multi-tier system.

• Each Service Provider account can create and manage customer accounts up to five tiers (for example, tier-1 Service Provider > tier-2 Service Provider > tier-3 Service Provider > tier-4 Service Provider > tier-5 Subscriber). For information go to Add or Delete a Managed Account.
• After a Service Provider creates a managed customer account, you can allocate users, devices, and licenses from your inventory to the account. For more information, go to Inventory Management.
• Each managed customer account has its own WatchGuard Cloud account and its own operators (users who can log in to WatchGuard Cloud to view and manage account information and configure services).
• For each account they manage, a Service Provider can use the Subscriber view, configure WatchGuard products and services, and view reports.

For more detailed information about how to manage accounts, go to Account Management.

Account Groups and Operator Permissions

Service Providers can use Account Groups to control account access in WatchGuard Cloud. To simplify account access management, set up account groups so that you can assign operator permissions to manage a group of similar accounts instead of each individual account.

For example, you might have some support staff who manage only a specific subset of all your Subscriber accounts. You want to make sure that you only enable access to the Subscribers the operators manage, and not all Subscribers in your WatchGuard Cloud Service Provider account. You can create different Account Groups and only allow access to the appropriate account group in the settings for the support staff operators.

For more detailed information, go to Manage Account Groups.

Account Groups and Policies for Endpoint Configuration

Service Providers can also use account groups to assign policies for endpoint configuration across multiple accounts.

• You can centrally manage the endpoint security of tenant Subscriber and Service Provider accounts and account groups in WatchGuard Cloud.
• You can apply endpoint security setting profiles and tasks to computers and devices on the network in the multi-tenant endpoint security management UI.

For more detailed information, go to About Multi-Tenant Management in Endpoint Security.

If Subscribers need help with the management of their accounts, they can delegate their account to a Service Provider. When a Subscriber delegates their account, this enables the Service Provider to manage the account and its products and services.

Services Providers can also manage inventory allocation for delegated Subscribers with a WatchGuard account (tier-1 Subscribers).

These are the primary use cases for account delegation:

• A Subscriber needs help to configure their products and services
• A Subscriber needs the Service Provider to manage their account while out of the office or unavailable
• A Subscriber purchased and activated WatchGuard products, but wants the Service Provider to configure and manage them
• A Subscriber wants the Service Provider to fully manage their account

Account delegation can be temporary or it can be permanent (until revoked). If customers contact you to request your help with the management of their accounts and you agree to do so, then they delegate their account to you. As the Service Provider, you must initiate the account delegation process with a request for account access.

For more detailed information on how to manage Subscriber account delegation, go to Manage a Delegated Account.

In Account Manager, you can group devices in folders.

• Folders help you to view the status and summarized data for groups of devices.
• When you select a folder, the right side of the window shows information about the devices in the folder.

• This enables you to open a folder to view only the devices at that location, and to view summary status and aggregated reports for those devices. For example, you can view the status and reports for a folder that contains several devices.
• Each folder can contain devices or other folders. You can create up to ten levels of folders to organize your devices.

You can organize your device folders in several ways, for example:

• You could organize devices at different office locations into separate folders, such as by geographic location (Seattle, Los Angeles, Toronto) or different buildings (Headquarters, 5th Street Warehouse), or floors within a building (5th Floor, 9th Floor, Basement)
• You could organize devices by operational departments such as IT, Sales, Marketing, Development, QA, and so on.

For more information, go to Device Folders.

Firebox templates provide a way to manage shared configuration settings for multiple cloud-managed Fireboxes.

• In a Firebox template, you can configure firewall policies and services just as you would for an individual Firebox, and then apply that template to multiple cloud-managed Fireboxes. For more information, go to About Firebox Templates.
• As a Service Provider, you can create Firebox templates that are available to devices in all your managed accounts.
• When you create a Firebox template in a Service Provider account, all Subscriber accounts inherit that template as a read-only template. For more information about template inheritance, go to Firebox Template Inheritance.
• Devices from multiple managed accounts can subscribe to the same template to provide a standard, consistent, and secure configuration.
• As a Service Provider, you can subscribe devices in any account you manage to the inherited template, or copy that template to create a new editable template.
• When you deploy a change to a Service Provider template, the template changes automatically deploy to all subscribed devices.

To plan your templates, identify common Firebox policies and services that you can group together. Instead of just one template, consider the use of multiple templates based on specific groups of policies and services. You can create a base template for standard settings that you apply to all Subscriber account devices, and then apply other templates as needed to enable different policies and services, based on the requirements of a specific Subscriber or group of Subscriber accounts.

These general examples show how as a Service Provider, you can use templates to configure and update cloud-managed devices in your Subscriber accounts.

Global Configuration Template

In this simplest configuration, you create a global template in your Service Provider account to use for devices in all Subscriber accounts.

In this example: 

• In the Service Provider account, create and deploy a template with global base settings that are applicable to all devices.
• In each Subscriber account, an operator subscribes all devices to the template.

Benefits:

• Service Provider creates and deploys the global template once.
• When the Service Provider updates and deploys the template, any changes deploy to all subscribed devices automatically.

Multiple Templates

In the Service Provider account, configure multiple templates that all Subscriber accounts inherit. With multiple templates, you can create a single base template that contains common settings that you can apply to multiple devices.

Then, you can create additional templates that enable and configure different policies, services, and features, and apply them as required for Subscriber accounts.

In this example:

• In the Service Provider account, you create and deploy multiple templates. For example:
  • Base — template with settings appropriate for most devices
  • Services — One or more templates that enable specific policies and services
• In Subscriber accounts, an operator subscribes specific devices to one or more templates as required for the deployment.

Benefits:

• The Service Provider creates each template once.
• When the Service Provider deploys an update to a template, any changes deploy to all subscribed devices automatically.
• You can use multiple templates to apply different policies and services as required, based on Subscriber account requirements.

As a Service Provider, you can upgrade the firmware for devices in any Subscriber account you manage. WatchGuard Cloud helps you keep the cloud-managed devices of your Subscribers up to date with the latest firmware release.

• Keep your device firmware current to make sure that you always have the latest security and product updates for the device. This includes updates to resolve emerging security vulnerabilities and to fix known product issues.
• You can view which devices have firmware upgrades available from the Device Firmware widget on your Dashboard.

• Click the widget to go to the Firmware Upgrades overview page where you can immediately upgrade one or more devices, or schedule firmware upgrades.

Use firmware update schedules to update your Subscriber devices. This enables you to automate the process for each Subscriber account and customize a schedule with appropriate times for each Subscriber to avoid network disruption. For more information on how to configure and schedule firmware upgrades, go to Manage Fireware Versions for Devices in WatchGuard Cloud.

• Make sure you subscribe to the WatchGuard Product and Support News blog for product updates, new firmware announcements, and support alerts.
• Read the What's New information and Release Notes to review the new features and resolved issues in a product release.
• To view the Release Notes of any product release, go to Release Notes.
• To view all product documentation, including the What's New information and Help for each release, go to watchguard.com/help.

As a Service Provider, it is important that you track the expiration of any device certificates installed on cloud-managed Fireboxes in your Subscriber accounts.

WatchGuard Cloud stores custom certificates that makes it easy to upload the same certificate across multiple Fireboxes. However, after you install the certificates, you must manage the certificates of each account and Firebox individually.

• Make sure that Firebox certificates are not expired or do not expire soon.
• To view the current list of certificates for a Subscriber account, select the Subscriber account, then select Administration > Certificates.
• To view specific device certificates, go to Configure > Devices > Device Configuration > Device Certificates.

From the Service Provider view, you can manage certificates on the Device Configuration page only. From the Subscriber view, you can manage certificates for your account or managed accounts in the Administration menu, or for your cloud-managed devices on the Device Configuration page.

For more detailed information, go to Manage Certificates in WatchGuard Cloud.

For Service Providers, the Dashboard page shows you a quick overview of your Service Provider account and your managed Service Provider and Subscriber accounts.

You can view information such as devices that have firmware upgrades available, the next license expiration, allocations for different products and services, and a ThreatSync incidents summary.

• On the Dashboard page, several widgets show important information and provide useful links.
• Different widgets appear when you select Overview, a Service Provider account, or a Subscriber account in Account Manager.
• The content of the widgets on the Overview page reflects aggregated data for all the accounts (Service Provider and Subscriber) you manage.
• To open the Overview page, in Account Manager, select Overview.

For more information, go to About the Configure Devices Overview Page.

ThreatSync is a WatchGuard Cloud service that provides eXtended Detection and Response (XDR) technology for WatchGuard devices and Endpoint Security products to detect and respond to threats. For more information, go to About ThreatSync.

As a Service Provider, you can view threat information for all the accounts you manage.

Monitor ThreatSync

In WatchGuard Cloud, select Monitor > Threats.

The Summary page provides a snapshot of incident activity for your Subscriber accounts. This page includes graphs and incident data and provides a snapshot of incident activity over a specified period of time.

The Incidents page shows a list of incidents for a specified time period and enables you to perform remediation actions.

• An incident is activity that is confirmed to be malicious.
• An incident can be as simple as an indicator of compromise, or as complex as an indicator of attack that sequences behaviors to determine malicious intent.

For more information, go to Monitor ThreatSync.

Configure ThreatSync Automation Policy Templates

You can create ThreatSync automation policy templates that include multiple automation policies and assign the template to the accounts or account groups you manage.

Each ThreatSync account also has two default automation policies. These default automation policies enable ThreatSync to take automatic action on the highest and lowest risk incidents so you can focus on the most important incidents that might require manual investigation and remediation.

These automation policy templates enable you to apply automation policies consistently across managed accounts, and save time when you set up ThreatSync for new accounts or account groups.

For example, you could create a policy that automatically deletes a file when ThreatSync detects a high or critical risk, such as a malicious file detected by APT Blocker. This automates the process of detection and remediation to delete the file on the computer with the WatchGuard Endpoint Agent.

For more information, go to Manage ThreatSync Automation Policy Templates (Service Providers).

WatchGuard provides useful summary reports that provide an overview of device status, network performance and security, and policy usage. For more detailed information about reports, go to View WatchGuard Cloud Device Reports.

As a Service Provider, you can schedule WatchGuard Cloud to run these reports automatically and send the reports to your customers by email. For more information, go to Scheduled Reports.

Executive Summary

In the WatchGuard Cloud Device Summary page, you can view a summary of status for all devices and the detailed status for each device. You can also generate an Executive Summary report for a device or devices.

The Executive Summary report is a PDF report that includes a high-level summary of the attacks and traffic blocked by the Firebox.

For more detailed information, go to Executive Summary (WatchGuard Cloud).

Policy Usage Report

The Policy Usage report is another report that you can generate for your customers to show policy usage by their users.

• The report shows a list of policies and how each policy was used, including how much traffic was handled by each policy in a selected time range.
• The report can help the customer understand which policies are used the most and if the policies are functioning the way they expect.
• If you plan to migrate Fireboxes from local management to cloud management, the report can help you plan and optimize your use of policies and templates.

For more information, go to Policy Usage Report.

Report Customization

You can change the logo and Reply-to Email Address displayed on the report from the default WatchGuard logo and email address to the logo and email address of the partner you manage. With custom branding, the logo and email address seen by the customer show that it was sent from the partner account.

Any custom branding for your account is inherited by the Subscriber accounts you manage, and you can customize each Subscriber as required. For more information, go to Add Custom Branding.

Alerts are notifications about your managed accounts, devices, or specific events that occur in WatchGuard Cloud.

Alerts make sure that you are aware of any significant changes that affect your managed accounts and devices. For example, you can receive an alert for events such as when a device feature key is about to expire.

You can view notifications from Administration > Notifications in WatchGuard Cloud.

For more information, go to Manage WatchGuard Cloud Alerts.

In the Rules section, you can review several default rules. You can also add customized rules for events specific to the accounts you manage, and enable email delivery for specific alarm notifications.

A helpful rule you can add is the Device Alarms rule that generates alert notifications when a device generates an alarm. For example, you can configure a device to generate an alarm when a security service detects a malicious file. Note that if you also enable Email notifications, this increases the potential volume of email alert messages.

You can integrate WatchGuard Cloud with your existing professional service automation (PSA) tools such as ConnectWise and Autotask. PSA tools help MSPs manage account data, tickets, billing, contracts, and reporting. When you integrate WatchGuard Cloud with your PSA tool, you can send product license usage data and device information to your PSA tool. You can also use notification rules to automate ticket updates in your PSA tool when events occur in WatchGuard Cloud (closed-loop ticketing).

With PSA integration, you can send this data to the PSA tool:

• Firebox information, including model, license type, serial number, firmware version, license expiration, and other metadata
• User allocation and license usage data for any WatchGuard Cloud-based product, including AuthPoint, Endpoint Security products, FireCloud, ThreatSync+ products, and Managed Services
• Closed-loop ticketing for ThreatSync, Endpoint Security, Firebox, License alerts, and WatchGuard Cloud notification rules

If you have an existing PSA integration for your cloud-managed Firebox or a locally-managed Firebox added to WatchGuard Cloud for reporting, we recommend you disable the integration in the Firebox configuration to prevent duplicate tickets or synchronization conflicts. For more information, go to About Firebox Technology Integrations (cloud-managed Fireboxes) or Technology Integrations (locally-managed Fireboxes).

To get started with WatchGuard Cloud PSA integration, go to Quick Start — Integrate WatchGuard Cloud with a PSA Tool.

These plug-ins enable you to integrate WatchGuard Endpoint Security products with third-party RMM tools. For more information, go to WatchGuard Endpoint Security Plug-Ins and Integrations.

• ConnectWise Automate Plug-in
• ConnectWise RMM Plug-in
• Kaseya Virtual System Administrator (VSA) Plug-in
• N-able N-central Plug-in
• N-able N-sight Plug-in
• NinjaOne Integration
• Splunk Splunkbase Integration

You can use SNMP (Simple Network Management Protocol) to monitor WatchGuard Fireboxes on your network. Your devices can accept polls from an SNMP management system and send SNMP trap messages for device events to an SNMP trap destination server.

For more information on how to configure SNMP on your WatchGuard device, go to:

• Locally-managed Fireboxes — Enable SNMP Polling for a Locally-Managed Firebox and Enable SNMP Management Stations and Traps for a Locally-Managed Firebox
• Cloud-managed Fireboxes — Configure SNMP Settings for a Cloud-Managed Firebox

When you configure SNMP on your Fireboxes, you can integrate with remote management and monitoring (RMM) solutions to monitor your devices.

• N-able N-central Integration Guide
• PRTG Integration Guide
• Auvik Integration Guide

On the Configure > Agent Deployment page in WatchGuard Cloud, you can configure whether the agent automatically installs WatchGuard software such as Endpoint Security or the WatchGuard Connection Manager for FireCloud.

For Service Providers, the Agent Deployment page is useful to centrally configure deployment behavior on endpoints when the account has more than one WatchGuard product. For more information, go to Configure WatchGuard Agent Deployment in WatchGuard Cloud.

MSSPs can enroll in a flexible prepaid points program. Partners can manage and allocate these prepaid points to tenants. You can apply these points to most WatchGuard products. For more information about payment programs, go to WatchGuard Payment Programs and Product Bundling.

Products that you manage in WatchGuard Cloud and purchase with points show as a subscription. At the start of each calendar month, WatchGuard automatically deducts points from your total points available, based on the service type and monthly point allocation for each managed device and service.

From the WatchGuard Partner Portal, you can view the status of your points from MSSP Command in the Tools menu.

If you use MSSP points, we recommend that you:

• Manage and view your points activity and allocation.
• You can view how you consume your points on a monthly basis and download a transaction history with an audit report for more detailed information.
• The audit report also includes user data for full details about your points usage.
• Make sure you have enough points for the next month.
• An Alerts tile shows you the number of alerts related to the points for your account in the past ninety days. Click this tile to view a list with information about the alerts for your account.
• You can receive email notifications to make sure that you always know if you are below the required points threshold for your next renewal.

For more detailed information about MSSP Command, go to Get Started with MSSP Command.

WatchGuard offers sales training and certification for our partner community, and technical training and certification for all partners and customers. When you keep current on training and certification, you demonstrate to your customers that you sell and support products with which your employees have a high level of technical competence.

You can find all WatchGuard sales and technical training in the WatchGuard Learning Center.

If you are a WatchGuard Partner, you can view the current status of your technical and sales certifications from the Partner portal. For more information about certification, go to Partner Specializations and Certification on the WatchGuard web site.