Applies To: ThreatSync
When you enable ThreatSync for an account, it is automatically enabled on the Fireboxes, access points, and endpoint devices allocated to the account. These devices automatically send data to ThreatSync.
Use the Device Settings page to configure these settings for ThreatSync:
- Which devices send data to ThreatSync
- Whether ThreatSync is enabled automatically for new Fireboxes or access points
- Whether AuthPoint sends incident data to ThreatSync
- Whether ThreatSync+ sends incident data to ThreatSync
- Whether endpoint devices send incident data to ThreatSync and receive actions
- Whether ThreatSync is enabled for a specific Firebox or access point at the device level
Customers with WatchGuard Total MDR can only view, not edit, the configuration on the Device Settings page in ThreatSync.
To configure which products and devices send data to ThreatSync:
Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the ThreatSync Core permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.
- Select Configure > ThreatSync > Device Settings.
The Device Settings page opens. - To specify whether to send incident data from ThreatSync+ to ThreatSync, enable or disable the ThreatSync+ toggle.
- To specify whether to send incident data from AuthPoint to ThreatSync, enable or disable the AuthPoint toggle.
- To specify whether to send incident data from all endpoint devices to ThreatSync, enable or disable the Endpoints toggle.
- To automatically enable ThreatSync for any new devices you allocate to the account in WatchGuard Cloud, select the corresponding check box for Fireboxes and Access Points.
- To specify which specific Fireboxes and access points send data to and receive actions from ThreatSync, clear or select check boxes next to the Firebox and access point names.
- Click Save.
To enable or disable ThreatSync on a Firebox, at the device level:
- Select Configure > Devices.
- Select the Firebox.
- In the ThreatSync section, disable ThreatSync.
To enable or disable ThreatSync on an access point, at the device level:
- Select Configure > Devices.
- Select the access point.
- In the ThreatSync section, disable ThreatSync.
