Applies To: WatchGuard NDR
NDR is a cloud-based, network-centric threat detection and response solution that helps organizations identify, detect, and respond to network-based cyberattacks through an advanced, layered approach. NDR uses advanced artificial intelligence (AI) and machine learning capabilities to deliver enterprise-level cyber defense across hybrid networks.
Throughout this documentation, NDR refers generally to all NDR products. When a feature is specific to a product, refer to the Applies To statement at the top of the Help topic for information about which products the topic is relevant to.
WatchGuard NDR continuously monitors and analyzes data flows and provides:
- Detection and response for your physical and private networks.
- Network analysis of both north-south traffic (traffic that enters or exits your network) and east-west traffic (traffic within your network).
- An open solution for multivendor networks, including WatchGuard Fireboxes, third-party switches, and third-party firewalls.
- Executive Summary and Ransomware Prevention Defense Goal reports.
- An optional Compliance Reporting or Total NDR license adds continuous compliance reporting for cyber networks.
WatchGuard NDR deploys across multiple locations and quickly integrates with your existing environment. Automation eliminates the need for threat hunters and forensic analysts.
NDR monitors:
- Authentication threats, such as password and credential attacks.
- Network and cloud risks, including firewall rule failures and unsecured ports.
- Cyberattacks, including ransomware and supply chain attacks.
- File and data threats, such as the movement of sensitive files to public clouds or open file shares.
NDR correlates these events and delivers actionable intelligence in the form of a network threat score that helps you to prioritize remediation actions. For more information, go to Network Threat Score.
For more information about WatchGuard NDR, go to these sections:
Licensing
To use WatchGuard NDR, you must purchase and activate a WatchGuard NDR or a Total NDR license. WatchGuard NDR is licensed for each user. WatchGuard NDR will monitor active network devices up to two times the number of users in the license. For example, if your license is for 250 users, then WatchGuard NDR monitors network traffic for up to 500 active network devices (for example, workstations, mobile phones, IP phones, servers, cameras, or other IOT devices). To see a graph of the number of internal devices monitored over time, you can review the WatchGuard NDR monitoring dashboard (Monitor > Network Summary > Total Devices > Devices Over Time).
For more information about licensing, go to About WatchGuard NDR Licenses and About Total NDR Licenses.
For more information about WatchGuard NDR licensing and enforcement, go to this Knowledge Base article: FAQ on WatchGuard NDR Licensing 
(Optional) WatchGuard Compliance Reporting License
To use Compliance Reporting in WatchGuard Cloud, you must activate a WatchGuard NDR license and a Compliance Reporting license. Like WatchGuard NDR, Compliance Reporting is licensed for each user. It provides access to the reports in WatchGuard Cloud.
To make sure that Compliance Reporting reflects device data from all WatchGuard NDR users, we recommend that the number of users in your WatchGuard Compliance Reporting license matches the number of users in the WatchGuard NDR license. For example, if you purchase a WatchGuard NDR license for 250 users, then purchase a WatchGuard Compliance Reporting license for 250 users.
The Total NDR license includes WatchGuard NDR and Compliance Reporting. For more information, go to About WatchGuard Compliance Reporting Licenses and About Total NDR Licenses.
Data Collection
To gain visibility into all areas of your network, you should monitor IP traffic across all the devices in your network. Cloud-managed and locally-managed Fireboxes with cloud reporting that run Fireware v12.10.3 and higher automatically send network traffic data to WatchGuard Cloud and NDR. (For locally-managed Fireboxes with cloud reporting, you must enable the Firebox to send log messages for reports in each packet filter policy.) This data feed provides the information required for WatchGuard NDR to identify and detect potential threats and suspicious activities, such as lateral movements, DNS tunnels, fast and slow scans, and data exfiltration.
For Fireboxes that run lower versions of Fireware or third-party firewalls or switches, on-premise collection devices called collection agents are used to monitor network traffic. Collection agents take data feeds such as NetFlow and sFlow from third-party switches and firewalls, and forward them through a secure connection to WatchGuard Cloud. These data feeds include information on the traffic that flows through the switch or firewall to network devices. We recommend that you configure your switches and firewalls to relay network traffic data through these collection agents to be forwarded to WatchGuard Cloud. For information on how to install and configure collection agents on Linux computers and servers, go to Configure Collection Agents for WatchGuard NDR (Linux Computers). For information on how to install and configure collection agents on Windows computers and servers, go to Configure Collection Agents for WatchGuard NDR (Windows Computers).
In addition to the Firebox, you can also install agent-based collection agents on third-party switches and firewalls to relay NetFlow, sFlow, VPN, and Active Directory or DHCP logs to WatchGuard Cloud through a secure IPSec tunnel.
WatchGuard NDR retains 45 days of logs.
Reports
Reports are a critical part of monitoring your organization for threats. NDR provides reports that enable you to track the health of your network.
WatchGuard NDR includes these default reports:
- Executive Summary Report
- Ransomware Prevention Defense Goal Report
To add more reports, plus the ability to generate custom reports, we recommend you add a WatchGuard Compliance Reporting or a Total NDR license. WatchGuard Compliance Reporting provides additional defense goal reports for cybersecurity regulations and standards, as well as the ability to generate custom reports for specific defense goals.
The WatchGuard Compliance Reporting license includes these reports:
Cyber Essentials Certification
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the National Cyber Security Centre Cyber Essentials certification. This certification helps you protect your organization against the most common cyber attacks.
FFIEC
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the Federal Financial Institutions Examination Council (FFIEC) guidelines. These guidelines help financial institutions operate safely, mitigate risk, comply with applicable regulations, follow legal requirements, and adequately manage cybersecurity risks.
ISO 27001 – Information Security, Cybersecurity and Privacy Protection
There are two versions of the ISO 27001 Defense Goal report — one for the 2013 version of the standard and one for the 2022 version.
These reports provide an overview of your network defense and show whether you are in compliance with the objectives and controls outlined by ISO 27001. This standard provides companies with guidance to establish, implement, maintain, and improve information security management systems.
Motion Picture Association Content Security Program
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the Motion Picture Association (MPA) Content Security Program. This program is a set of voluntary content security best practices to protect intellectual property against theft, piracy, and tampering.
NIST 800-53 – Security and Privacy Controls for Information Systems and Organizations
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the National Institute of Standards and Technology (NIST) guideline 800-53. NIST 800-53 provides a catalog of guidelines that support the development of secure and resilient federal information systems. These guidelines include operational, technical, and management safeguards to maintain the integrity, confidentiality, and security of federal information systems.
NIST 800-171 – Protecting Controlled Unclassified Information in Non-federal Systems and Organizations
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the National Institute of Standards and Technology (NIST) guideline SP 800-171. NIST SP 800-171 sets standards for safeguarding sensitive information on federal contractor IT systems and networks.
NIST CSF – Cybersecurity Framework
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the National Institute of Standards and Technology (NIST) cybersecurity framework (CSF). The CSF provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It includes a taxonomy of high-level cybersecurity outcomes that organizations can use to better understand, assess, prioritize, and communicate their cybersecurity efforts.
Network and Information Security Directive (NIS2) – Legal Framework
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the Network and Information Security Directive (NIS2) security requirements. The NIS2 directive provides the European Union with legislative guidance for business continuity, supply chain security, security in network and information systems acquisition, and vulnerability management. Compliance with NIS2 helps organizations enhance their cybersecurity capabilities and makes them more resilient against cyber threats.
Digital Operational Resilience Act (DORA) – Risk Management Framework
This report provides an overview of your network defense and shows whether you are in compliance with the objectives and controls outlined by the Digital Operational Resilience Act (DORA). DORA is a comprehensive European Union regulation for the financial sector that provides regulation for banks, insurance companies, investment firms, and other financial service providers. This regulation ensures operational resilience to digital risks and threats in the financial sector.
Google Workspace
This report provides an overview of network defense and assesses whether you are in compliance. The report supports audit and compliance activities by documenting the presence of key security controls, identifying configuration gaps, and demonstrating the organization’s security posture over a defined reporting period.
For more information, go to About WatchGuard Compliance Reporting and About Total NDR.
Executive Summary Report
The Executive Summary Report provides a high-level overview of the threats and vulnerabilities that WatchGuard NDR detects. The report includes an overall network threat score and shows you changes in the trend of the threat score over time. Lower scores indicate that your network might not be fully protected.
The included metrics reflect the range of detection and response capabilities provided by WatchGuard NDR. The overall network threat score is calculated from metrics across three areas of protection: Threat Detection, Network Visibility, and Policy Assurance.
Follow the recommendations in the report to improve your threat score and protect your network.
For more information, go to WatchGuard NDR Executive Summary Report.
Ransomware Prevention Defense Goal Report
The Ransomware Prevention Defense Goal Report monitors your network for vulnerabilities that can make you more susceptible to ransomware. This report presents a summary of the controls WatchGuard NDR monitors to help you prevent the spread of ransomware. Each control included in the report is based on a WatchGuard NDR policy.
The Ransomware Prevention Defense Goal Report provides you with a network defense overview and shows whether you are in compliance with the objectives and controls for a specified time period. This report, in addition to continuous monitoring of your policy alerts and closing Smart Alerts, can prove compliance for audit or cyber insurance purposes.
For more information, go to Ransomware Prevention Defense Goal Report.
NDR UI
To configure and monitor NDR, you use the NDR UI in WatchGuard Cloud. To connect to WatchGuard Cloud, go to cloud.watchguard.com and log in with your account credentials.
Monitor NDR
WatchGuard NDR automatically collects data from your Fireboxes in WatchGuard Cloud and includes default policies and Smart Alerts to help you monitor potential issues in your network.
Available pages and features vary and depend on your license type. Throughout this documentation, NDR refers generally to all products. If you do not see a page or feature in the NDR UI, it is not supported by your product.
To monitor NDR, select Monitor > NDR.
Use these pages to monitor NDR:
- Network Summary — Provides an overview of trends in your network and includes links to detailed information about Smart Alerts, policy alerts, device risks, users, and network traffic. For more information, go to About the NDR Summary Page.
- Smart Alerts — Shows open Smart Alerts that indicate an attack might be in progress on your network and provides guidance to help you remediate the threat. For more information, go to About Smart Alerts.
- Policy Alerts — Shows alerts for policy violations on your network. For more information, go to About Policy Alerts.
- Users — Shows details about user activity and threat detection in Microsoft 365. This page is available with a WatchGuard SaaS DR or a Total NDR license. For more information, go to About WatchGuard SaaS DR Licenses, About Total NDR Licenses and WatchGuard NDR and WatchGuard SaaS DR Users.
- Discover — Shows subnets and important servers and network devices that NDR automatically identifies. For more information, go to WatchGuard NDR Asset Discovery.
- NDR Audit Logs — Shows details of any configuration activity performed for NDR policies and zones on your network, shows IP address and user remediation history, and shows logs for SaaS collection agents and Smart Alert controls. For more information, go to NDR Audit Logs.
- Search Raw Logs — Shows details about Microsoft 365 document and user access logs. You can use the information on this page to search, sort, and filter Microsoft 365 raw logs. For more information, go to Search Raw Logs in WatchGuard SaaS DR.
- All IP Addresses — Shows details about internal and external IP addresses. You can use the information on this page to view detailed information about IP address activity, device activity, view associated Smart Alerts and policy alerts, and you can perform manual block and unblock actions on specific external IP addresses. For more information, go to All IP Addresses.
Configure NDR
You can configure NDR specifically for your organization and network.
To configure NDR, select Configure > NDR.
You can use these pages to configure NDR:
- Executive Summary Report — Configure settings for your Executive Summary Report. For more information, go to Configure the Executive Summary Report Settings.
- Compliance Reports — Manage your network defense goals and objectives for defense goal reports. For more information, go to Manage Network Defense Goals.
- Subnets and Organizations — Configure subnets and ranges of IP addresses to label your internal networks and important systems to help identify rogue devices. For more information, go to Configure Subnets and Organizations.
- Devices — Manage devices on your network and add or import new devices. For more information, go to Manage Devices.
- Policies — Manage default policies and add policies with custom policy definitions for your network. For more information, go to Configure WatchGuard NDR and WatchGuard SaaS DR Policies.
- Zones — Manage zones in your network and create custom zones. For more information, go to Manage NDR Zones.
- Alerts — Specify which policy alerts, Smart Alerts, collection agents, and remediation alerts generate email notifications. For more information, go to Configure WatchGuard NDR and WatchGuard SaaS DR Alerts and Notification Rules for Subscribers.
- Smart Alert Controls — Configure rules to filter Smart Alerts. For more information, go to Configure WatchGuard NDR Smart Alert Controls.