Applies To: WatchGuard Core MDR, WatchGuard Core MDR for Microsoft, WatchGuard Total MDR
The Managed Services portal offers insights into the actions performed by WatchGuard MDR to protect your environment. You can use the portal to review the most recent security activity for your managed accounts and to download reports.
To view activity in the Managed Services portal, you must activate a WatchGuard Core MDR, WatchGuard Core MDR for Microsoft, or WatchGuard Total MDR license and allocate the license in WatchGuard Cloud. For more information, go to About WatchGuard MDR Licenses.
If no data shows in the Managed Services portal, the service is still active and no detections have occurred. The portal shows data only after an event with potential security implications is detected. After you allocate users from the WatchGuard MDR license, it might take up to 6 hours for activity to show in the portal.
To open the Managed Services portal, from WatchGuard Cloud:
- Select Monitor > Managed Services.
The Managed Services portal opens in a new browser tab.
- If you are a Service Provider, select an account from the drop-down list.
The dashboard shows the data for your account.
As a tier-1 Service Provider, to see data in the Managed Services portal for a Subscriber account in one of your managed Service Provider accounts hierarchy, you must create a new operator in the managed Service Provider account. You can then log in to WatchGuard Cloud as the new operator and go to Monitor > Manage Services.
After 1 hour of inactivity, your Managed Services portal session times out. To end your session, close the browser tab.
Permissions
The actions you can take in the Managed Services portal depend on your WatchGuard Cloud operator role.
Service Provider
- Sales, Auditor — Sales and Auditor operators can view key metric data, investigations, detections, and reports for their Subscriber accounts.
- Helpdesk — Helpdesk operators can take actions on investigations, such as reset passwords or dismiss detections. They can also contact the WatchGuard SOC team directly with comments in investigation details.
- Owner — Owner operators have full permissions for their Subscriber accounts. They can take actions on investigations, contact the WatchGuard SOC team directly with comments in investigation details, and configure onboarding settings for their Subscriber accounts.
Subscriber
- Observer — Observer operators can view key metric data, investigations, detections, and reports for their account.
- Analyst — Analyst operators can take actions on investigations, such as reset passwords or dismiss detections. They can also contact the WatchGuard SOC team directly with comments in investigation details.
- Admin — Admin operators have full permissions for their account. They can take actions on investigations, contact the WatchGuard SOC team directly with comments in investigation details, and configure onboarding settings for their account.
For information about how to use the Managed Service portal, go to:
- Managed Services Portal Dashboard
- Review MDR Investigations
- Review MDR Detections
- View MDR Reports
- Review MDR Endpoints
- Review MDR Connection Service Status