Applies To: WatchGuard NDR, Total NDR
Security Information and Event Management (SIEM) integration enables WatchGuard NDR to send notifications to a SIEM server through syslog in Common Event Format (CEF). With this capability, organizations can forward alerts to a central SIEM server to monitor, correlate, and analyze security events more effectively, improving threat detection and compliance. This integration expands the WatchGuard Cloud notification framework and adds syslog delivery as an alternative to email notifications for WatchGuard NDR.
For more information about WatchGuard NDR SIEM integration, go to these sections:
Licensing
To use SIEM integration with WatchGuard NDR, you must purchase and activate a WatchGuard NDR or Total NDR license. WatchGuard NDR and Total NDR are licensed for each user.
For more information about licensing, go to About WatchGuard NDR Licenses and About Total NDR Licenses.
Add a SIEM Integration
To add a SIEM integration, log in to your Subscriber account in WatchGuard Cloud and select Administration > System > Integrations.
The SIEM Integration page shows these details:
- Name — The name of the SIEM integration.
- Delivery — The WatchGuard NDR Collection Agent that sends notifications to the SIEM server.
- Last Update — The time and date the SIEM integration was last updated.
- Status — The status of the SIEM integration. The status can be Connected or Disconnected.
For more information, go to Configure a WatchGuard NDR SIEM Integration.
Configure SIEM Alerts and Notification Rules
To configure SIEM alerts and notification rules, you specify which alerts generate a notification when they are created or updated.
From the SIEM Alerts tab on the Configure > NDR > Alerts page, select which alerts you want included in your notifications.
To configure SIEM notifications, enable SIEM on the Administration > Notifications page and select which SIEM configuration to use for the notifications.
Because Total NDR includes WatchGuard SaaS DR, the SIEM delivery method is available for WatchGuard SaaS DR notifications in accounts with a Total NDR license.
For more information, go to Configure WatchGuard NDR and WatchGuard SaaS DR Alerts and Notification Rules for Subscribers.