Configure WatchGuard Core MDR Settings

Applies To: WatchGuard Advanced EPDR This topic applies to the WatchGuard Advanced EPDR endpoint security product., WatchGuard EPDR This topic applies to the WatchGuard EPDR endpoint security product., WatchGuard EDR This topic applies to the WatchGuard EDR endpoint security product.

Applies To: WatchGuard Core MDR This topic applies to the WatchGuard Core MDR managed service.

For environments that use Endpoint Security products such as Advanced EPDR, EPDR, and EDR, WatchGuard Core MDR enables the WatchGuard SOC team to monitor your licensed endpoints and your cloud-based Office 365 environment. For more information, go to About WatchGuard MDR.

After you purchase, activate, and allocate the WatchGuard Core MDR license for a new customer in WatchGuard Cloud, complete the MDR settings in the WatchGuard Endpoint Security UI. The information you provide helps the WatchGuard SOC team understand the customer environment, which devices provide critical services, and whether WatchGuard can automatically isolate infected computers.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Configure MDR permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.

Before you begin, you must activate your WatchGuard Core MDR license and allocate the endpoints in WatchGuard Cloud. For more information, go to Activate an Endpoint Security License and Allocate Endpoints.

To complete the WatchGuard Core MDR customer settings:

1. In WatchGuard Cloud, select the Subscriber account for the customer.
2. Select Configure > Endpoints.
3. Select Settings.
4. From the left pane, select MDR.
   The WatchGuard Core MDR settings page opens.
5. From the Customer Business Vertical section, select the business vertical for the customer.
6. In the Number of Business Locations text box, enter the number of locations.
7. In the Number of Employees text box, enter the number of employees.
8. If the customer has remote employees, enable Includes Remote Employees.
9. From the Operating Systems section, select the operating systems used by the customer.
10. In the Hardware Devices section, add the hardware vendors and devices used in the customer network.
    1. Click Add Hardware Vendor.
    2. In the Hardware Vendor text box, enter the hardware vendor name.
    3. Select the hardware types for the vendor.
    4. Repeat these steps to add additional hardware devices.
11. In the Critical Computers section, specify computers that provide a critical service or require additional attention.
    1. Click Add Computers.
    2. To select a group of computers, from the Computer Groups list, select a group.
    3. To select individual computers, from the Additional Computers list, select the critical computers.
    4. Click Add.
12. To allow the WatchGuard SOC team to isolate computers on the customer network, in the Response Plan section, enable Allow WatchGuard Security Operations Center to Isolate Computers on the Customer Network.
13. To add computers that WatchGuard cannot isolate without additional approval, in the Exceptions section, click Add Computers.
1. To select a group of computers, from the Computer Groups list, select a group.
2. To select individual computers, from the Additional Computers list, select the critical computers.
3. Click Add.
14. Click Save.

To help you mitigate and remediate identified threats, WatchGuard MDR automatically delivers periodic health status and service activity reports. The SOC team sends reports to the recipient email addresses you provide in the Managed Services portal, Tenant Settings page. For more information, go to MDR Reports.

Confirm WatchGuard Endpoint Security Installation and Configuration

For a successful implementation of the WatchGuard Core MDR service, it is important that WatchGuard Endpoint Security software is correctly deployed and configured on your customer's endpoints.

To help you verify your customer's WatchGuard Endpoint Security products are configured correctly and securely, the onboarding team provides a checklist of important configuration settings. Make sure that:

• The WatchGuard Endpoint Agent is installed on all endpoints.
• The management UI is protected by multi-factor authentication.
• Anti-tamper protection is enabled.
• Protection cannot be uninstalled without a password.
• All endpoints are configured to use Hardening or Block mode.
• Anti-exploit protection is enabled for all endpoints.

WatchGuard also recommends that you allocate the WatchGuard Full Encryption and Patch Management modules to the customer account.

Related Topics

About WatchGuard MDR

WatchGuard Endpoint Security Modules