View MDR Reports

Applies To: WatchGuard Core MDR This topic applies to the WatchGuard Core MDR managed service., WatchGuard Core MDR for Microsoft This topic applies to the WatchGuard Core MDR for Microsoft managed service., WatchGuard Total MDR This topic applies to the WatchGuard Total MDR managed service.

WatchGuard MDR automatically delivers periodic health status and service activity reports to help you mitigate and remediate identified threats. The reports and content are different for different WatchGuard MDR products.

Monthly Summary Report

The monthly report provides a comprehensive overview of managed services activity in your environment for the previous month. It includes all closed investigations related to potential security activity that was identified for that period. The content and number of reports are specific to your Managed Service product.

WatchGuard Core MDR

One report that includes a summary of closed investigations for endpoints with WatchGuard Advanced EPDR, EPDR, or EDR. If you connect WatchGuard MDR with Microsoft 365, the monthly report also includes information about investigations in your Microsoft 365 environment.

WatchGuard Core MDR for Microsoft

One report that includes a summary of closed investigations for endpoints with Microsoft Defender for Endpoints. If you connect WatchGuard MDR with Microsoft 365, the monthly report also includes information about investigations in your Microsoft 365 environment.

WatchGuard Total MDR (2 reports)

One report that includes a summary of closed investigations for endpoints with WatchGuard Advanced EPDR, EPDR, or EDR.

One report that includes a summary of closed investigations for Fireboxes, AuthPoint, ThreatSync, ThreatSync+ NDR, and cloud-based Microsoft 365, AWS CloudTrail, and Google Workspace.

Weekly Summary Report (WatchGuard Core MDR and WatchGuard Total MDR only)

Weekly report for WatchGuard Endpoint Security products that includes updates on health issues or significant misconfigurations that could degrade the overall security posture of the environment or negatively impact the protection, monitoring, investigation, or the ability to take response actions. The report also includes recommended actions to mitigate and remediate identified threats.

WatchGuard MDR sends reports to the recipient email addresses you provide on the portal Tenant Settings page. For steps to add recipients, go to Add MDR Report Recipients.

View MDR Reports in the Portal

After WatchGuard MDR sends the report, you can find the report on the Reports page in the Managed Services portal.

To view MDR reports:

1. In WatchGuard Cloud, select Monitor > Managed Services.
   The Managed Services portal opens in a new browser tab.
2. If you are a Service Provider, select your Subscriber account from the drop-down list.
3. Select Reports > Files.

4. From the Tags column, click the report you want to view.
5. Click .
   The report opens as a PDF in a new browser tab.

Add MDR Report Recipients

You can add the email addresses for report recipients in the Managed Services portal.

To add email recipients, you must be a Service Provider with the Owner or Helpdesk role, or a Subscriber with the Admin or Analyst role.

To add report recipients:

1. In WatchGuard Cloud, select Monitor > Managed Services.
   The Managed Services portal opens in a new browser tab.
2. If you are a Service Provider, select your Subscriber account from the drop-down list.
3. In the upper, right corner of the Managed Services portal, click .

4. From the drop-down list, select Onboarding.
5. From the navigation menu, select Tenant Settings.
   The Tenant Settings page opens.

6. To add recipients for monthly or weekly executive reports, in the text boxes, add up to three email addresses. Separate email addresses with a comma or use a distribution list to add more recipients.
7. Click Save.

Share Files With the SOC Team

If you want to share files related to an investigation with the SOC team, you can upload those files to the File Storage page in the Managed Services portal.

To upload a file to share with the SOC team:

1. In WatchGuard Cloud, select Monitor > Managed Services.
   The Managed Services portal opens in a new browser tab.
2. If you are a Service Provider, select your Subscriber account from the drop-down list.
3. Select Reports > Files.
   The File Storage page opens.

4. Click Upload.

5. Drag the file from your computer to the File Upload dialog box.
6. Click Upload.

Related Topics

About the Managed Services Portal

About Managed Services with WatchGuard MDR