About WatchGuard EDR Core

WatchGuard EDR Core is included in the Firebox Total Security Suite license. EDR Core includes a subset of WatchGuard EDR features and supports XDR capabilities through ThreatSync. You can install EDR Core alongside third-party endpoint products to detect and protect against fileless and malwareless attacks, including ransomware and APTs. EDR Core also includes anti-tampering and anti-exploit protection, as well as contextual detections, decoy files, and VPN validation.

For information on ThreatSync, go to About ThreatSync.

EDR Core includes a subset of the features available with WatchGuard EDR and is a replacement for the Threat Detection and Response (TDR) Host Sensor. EDR Core does not include a firewall, antivirus, web access or device control, shadow copies, or program blocking. You must upgrade to WatchGuard Advanced EPDR or EPDR to take advantage of these features, the Zero-Trust Application Service, and endpoint security modules. When you purchase and activate Passport or an endpoint security subscription license for WatchGuard EPDR, the existing EDR Core license with Total Security Suite automatically upgrades to WatchGuard EPDR. The EDR Core license becomes inactive. For information on how to upgrade your EDR Core license to WatchGuard EPDR, go to Activate an Endpoint Security License.

EDR Core supports these client platforms:

  • Windows (Intel and ARM)
  • Linux
  • macOS (Intel and ARM)

For more information, go to Installation Requirements (external) in the WatchGuard Endpoint Security Release Notes.

Get Started with EDR Core

For information about how to get started with EDR Core, go to:

Related Topics

About WatchGuard Cloud

Quick Start — Set Up ThreatSync

Manage Security Services