As you monitor threats detected by ThreatSync and review incident details, you might decide to take action to remediate an incident, or to reverse an action taken automatically by a WatchGuard product or service.
To send data to ThreatSync and receive actions, Fireboxes must run Fireware v12.9 or higher and be added to WatchGuard Cloud for logging and reporting or cloud management.
You can perform these actions manually from the ThreatSync UI:
- Block IP/Unblock IP — Blocks or unblocks the external IP address associated with the incident. When you select this action, all Fireboxes in the WatchGuard Cloud account block or unblock connections to and from the IP address.
IP addresses blocked by ThreatSync do not appear on the Firebox Blocked Sites list in Fireware or WatchGuard Cloud. For more information, go to Manage IP Addresses Blocked by ThreatSync.
- Delete File/Restore File — Deletes the flagged file associated with the incident, or restores a previously deleted file.
- Isolate Device/Stop Isolating Device — Isolates the computer from the network to prevent the spread of the threat, and to block the exfiltration of confidential data, or stops isolating a previously isolated computer.
- Kill Process — Terminates a process that exhibited malicious behavior associated with the incident.
Not all actions apply to all incident types.
To perform an action for one or more incidents, from the Incidents page:
- Select Monitor > Threats > Incidents.
The Incidents page opens. - Select the check box next to one or more incidents.
The Change Status and Actions menus appear. - From the Actions drop-down list, select the action to perform.
Recommendations for an incident on the Incident Details page determine what actions are available in the Actions drop-down list on the Incidents page. For example, if the recommended action for an incident is to isolate a device, the Isolate/Stop isolating device option is enabled in the Actions drop-down list.
To perform an action for an incident, from the Incident Details page:
- Select Monitor > Threats > Incidents.
The Incidents page opens. - Click an incident in the incident list.
The Incident Details page opens. - To perform an action:
- In the Threat Details section, click an action.
- In other sections, click the lightning bolt icon
to open the action menu, then select an action.
To perform an action for one or more endpoints, from the Endpoints page:
- Select Monitor > Threats > Endpoints.
The Endpoints page opens. - Select the check box next to one or more endpoints.
The Actions menu appears. - From the Actions drop-down list, select the action to perform.
If an error occurs and ThreatSync cannot perform an action, a red exclamation point icon or error message appears. For more information, go to Troubleshoot Incident Errors.
You can set up notifications to generate alerts when actions are performed. For more information, go to Configure ThreatSync Notification Rules.
Stop or Reverse an Action
If required, you can stop or reverse a previously performed action. For example, if you performed an action to block an IP address, you can unblock the IP address.
To stop or reverse an action, from the Incidents page:
- Select Monitor > Threats > Incidents.
The Incidents page opens. - In the left column, select the check box for one or more incidents.
The Change Status and Actions menus appear. - From the Actions drop-down list, select the action to stop or reverse.
To stop or reverse an action, from the Incident Details page:
- Select Monitor > Threats > Incidents.
The Incidents page opens. - Click an incident in the incident list.
The Incident Details page opens. - In the Threat Details section, select the action to stop or reverse.
To stop isolating an endpoint, from the Endpoints page:
- Select Monitor > Threats > Endpoints.
The Endpoints page opens. - Select the check box next to one or more endpoints.
The Actions menu appears. - From the Actions drop-down list, select Stop isolating.
To unblock an IP address, from the IPs Blocked by ThreatSync page:
- Select Configure > ThreatSync > IPs Blocked by ThreatSync.
The IPs Blocked by ThreatSync page opens. - Select one or more blocked IP addresses.
- Click Unblock.
All eligible Fireboxes no longer block traffic to and from the selected IP addresses.
Archive or Change the Status of Incidents