Applies To: All WatchGuard MDR Products
WatchGuard MDR is a managed detection and response service that keeps your licensed endpoints safe with security monitoring, threat hunting, attack detection, investigation, and containment.
WatchGuard MDR has two license categories:
- WatchGuard Core MDR Products — Core MDR, Core MDR for Microsoft, Total MDR, and Open MDR
- MDR Service Add-ons for WatchGuard Products — Add-on licenses for individual WatchGuard products and services
WatchGuard Core MDR is licensed as an Endpoint Security module. For more information on WatchGuard Core MDR, go to WatchGuard Endpoint Security Modules. For information on Endpoint Security product licenses, go to About Endpoint Security Licenses.
WatchGuard Core MDR for Microsoft, WatchGuard Total MDR, and WatchGuard Open MDR monitor one endpoint device for each licensed user.
WatchGuard Core MDR Products
The WatchGuard MDR portfolio includes these core products:
This table describes each product, the required endpoint detection and response (EDR) product, the environments WatchGuard MDR can monitor, and the additional requirements for those environments.
| Product | Description | EDR Product Required? | Monitored Environments | Additional Requirements |
|---|---|---|---|---|
| WatchGuard Core MDR |
Managed detection and response for endpoints protected by WatchGuard Endpoint Security. Optional Microsoft 365 monitoring is available. |
Yes Endpoint Security |
Endpoint Security | WatchGuard Endpoint Security Elite, Endpoint Security 360, Endpoint Security Prime, Panda Adaptive Defense, or Panda Adaptive Defense 360 license |
| Microsoft 365 |
Access to your Microsoft 365 environment For more information, go to Connect WatchGuard MDR with Microsoft 365. |
|||
| WatchGuard Core MDR for Microsoft | Managed detection and response for endpoints protected by Microsoft Defender for Endpoint. Optional Microsoft 365 monitoring is available. |
Yes Microsoft Defender for Endpoint |
Microsoft Defender for Endpoint |
Bring Your Own License (BYOL). Each endpoint that WatchGuard MDR monitors must have a Defender for Endpoint P1 or Defender for Endpoint P2 license. For more information about Microsoft subscriptions that we recommend, go to Connect WatchGuard MDR with Microsoft Defender for Endpoints. |
| Microsoft 365 |
Access to your Microsoft 365 environment For more information, go to Connect WatchGuard MDR with Microsoft 365. |
|||
| WatchGuard Total MDR | Full-stack managed detection and response for WatchGuard, spanning endpoints protected by WatchGuard Endpoint Security, Fireboxes, network detection and response (NDR), AuthPoint, and cloud environments (Microsoft 365, AWS, Google Workspace, and Azure and AWS Cloud Security Posture Management (CSPM)). |
Yes WatchGuard Endpoint Security |
WatchGuard Endpoint Security | WatchGuard Endpoint Security Elite, Endpoint Security 360, or Endpoint Security Prime license |
| WatchGuard Fireboxes | Total Security Suite (TSS) or Prime Security Suite (PSS) license | |||
| FireCloud | FireCloud license | |||
| WatchGuard NDR | WatchGuard NDR license | |||
| AWS CloudTrail |
Access to your AWS environment For more information, go to Connect WatchGuard MDR with AWS CloudTrail. |
|||
| Google Workspace |
Access to your Google Workspace environment For more information, go to Connect WatchGuard MDR with Google Workspace. |
|||
| Microsoft 365 |
Access to your Microsoft 365 environment For more information, go to Connect WatchGuard MDR with Microsoft 365. |
|||
| Azure Cloud Security Posture Management (CSPM) |
Access to your Microsoft Azure environment For more information, go to Microsoft Azure Cloud Security Posture Management (CSPM) with WatchGuard MDR. |
|||
| AWS Cloud Security Posture Management (CSPM) |
Access to your AWS environment For more information, go to AWS Cloud Security Posture Management (CSPM) with WatchGuard MDR. |
|||
| AuthPoint | AuthPoint Multi-Factor Authentication or AuthPoint Total Identity Security license | |||
| WatchGuard Open MDR | Flexible managed detection and response for environments that use Endpoint Security, CrowdStrike Falcon Insight, or Microsoft Defender for Endpoint. Supports monitoring for WatchGuard and third-party firewalls, cloud services, identity providers, network detection and response (NDR), and products such as Firebox and AuthPoint. |
Yes WatchGuard Endpoint Security, CrowdStrike EDR, or Microsoft Defender for Endpoint |
WatchGuard Endpoint Security |
WatchGuard Endpoint Security Elite, Endpoint Security 360, or Endpoint Security Prime license |
| CrowdStrike EDR |
Bring Your Own License (BYOL). Falcon Insight license from CrowdStrike For more information, go to CrowdStrike EDR Integration with WatchGuard Open MDR. |
|||
| Microsoft Defender for Endpoint |
Bring Your Own License (BYOL). Each endpoint that WatchGuard MDR monitors must have a Defender for Endpoint P1 or Defender for Endpoint P2 license. For more information about Microsoft subscriptions that we recommend, go to Connect WatchGuard MDR with Microsoft Defender for Endpoints. |
|||
| WatchGuard Fireboxes |
Total Security Suite (TSS) or Prime Security Suite (PSS) license |
|||
| FireCloud | FireCloud license | |||
| WatchGuard NDR | WatchGuard NDR license | |||
| Supported third-party firewalls | You must have the required license and permissions for your third-party firewall to configure syslog forwarding. For more information and a list of supported firewalls, go to WatchGuard MDR Integration Guides. | |||
| AWS CloudTrail |
Access to your AWS environment For more information, go to Connect WatchGuard MDR with AWS CloudTrail. |
|||
| Google Workspace |
Access to your Google Workspace environment For more information, go to Connect WatchGuard MDR with Google Workspace. |
|||
| Microsoft 365 |
Access to your Microsoft 365 environment For more information, go to Connect WatchGuard MDR with Microsoft 365. |
|||
| Azure Cloud Security Posture Management (CSPM) |
Access to your Microsoft Azure environment For more information, go to Microsoft Azure Cloud Security Posture Management (CSPM) with WatchGuard MDR. |
|||
| AWS Cloud Security Posture Management (CSPM) |
Access to your AWS environment For more information, go to AWS Cloud Security Posture Management (CSPM) with WatchGuard MDR. |
|||
| AuthPoint | AuthPoint Multi-Factor Authentication or AuthPoint Total Identity Security license | |||
| Okta |
Access to your Okta environment For more information, go to Okta Integration with WatchGuard Open MDR. |
|||
| Duo |
Access to your Duo environment For more information, go to Duo Integration with WatchGuard Open MDR. |
MDR Service Add-ons for WatchGuard Products
MDR service add-ons for WatchGuard products add MDR monitoring or related services to individual WatchGuard products. The WatchGuard MDR portfolio includes these MDR service add-ons:
- WatchGuard MDR for Endpoint Security
- WatchGuard MDR for AuthPoint
- WatchGuard MDR for NDR
- WatchGuard MDR for FireCloud
- WatchGuard MDR for Firebox
- WatchGuard Open MDR 3rd Party Log Storage Service
- WatchGuard MDR Vulnerability Scanner
- WatchGuard VCISO for MDR
This table describes each MDR service add-on for WatchGuard products, the environments it covers, and the additional requirements for the license.
| MDR Service Add-on | Description | Monitored Environments | Additional Requirements |
|---|---|---|---|
| WatchGuard MDR for Endpoint Security | 24/7 MDR monitoring for WatchGuard Endpoint Security alerts. | WatchGuard Endpoint Security | WatchGuard Endpoint Security Elite, Endpoint Security 360, or Endpoint Security Prime license. The number of users or endpoints in the add-on license must be the same as the number of endpoints in the Endpoint Security license. |
| WatchGuard MDR for AuthPoint | 24/7 MDR monitoring for AuthPoint authentication and identity events. | AuthPoint | The number of users or endpoints in the add-on license must be the same as the number of users in the AuthPoint Multi-Factor Authentication or AuthPoint Total Identity Security license. |
| WatchGuard MDR for NDR | 24/7 MDR monitoring for WatchGuard NDR network traffic telemetry. | WatchGuard NDR | The number of users or endpoints in the add-on license must be the same as the number of users in the WatchGuard NDR or WatchGuard Total NDR license. |
| WatchGuard MDR for FireCloud | 24/7 MDR monitoring for FireCloud traffic and access events. | FireCloud | The number of users or endpoints in the add-on license must be the same as the number of users in the FireCloud Internet Access or FireCloud Total Access license. |
| WatchGuard MDR for Firebox | 24/7 MDR monitoring for Firebox firewall logs and security events. | WatchGuard Fireboxes |
Total Security Suite (TSS) or Prime Security Suite (PSS) subscription. The number of Fireboxes in the add-on license must be the same as the number of Fireboxes covered by the TSS or PSS subscription. For supported Firebox models, go to Supported Firebox Models. |
| WatchGuard Open MDR 3rd Party Log Storage Service | Managed log storage and retention for MDR investigations and compliance (1 GB per day). | Third-party firewall logs |
An active WatchGuard Open MDR license on the same Subscriber account. You cannot activate this license alone and it cannot coexist with any other WatchGuard MDR license. |
| WatchGuard MDR Vulnerability Scanner | Scans your internal and external network for vulnerabilities. | Internal and external network |
An active WatchGuard MDR license on the same Subscriber account. You cannot activate this license alone. WatchGuard Open MDR 3rd Party Log Storage Service does not meet this requirement. For more information, go to Configure WatchGuard MDR Vulnerability Management. |
| WatchGuard VCISO for MDR |
On-demand Virtual Chief Information Security Officer (CISO) advisory for strategy, governance, risk, and compliance (minimum five hours each quarter). Hours do not carry forward to the next quarter. |
WatchGuard environment |
An active WatchGuard Total MDR license on the same Subscriber account. For more information, reach out to your WatchGuard representative. |
Supported Firebox Models
WatchGuard MDR for Firebox supports these Firebox models:
- Firebox T Series — NV5, T15, T20, T20-W, T25, T40, T40-W, T45, T45-POE, T45-CW, T80, T85-PoE, T115-W, T125, T125-W, T145, T145-W, T175, T185
- Firebox M Series — M270, M290, M295, M370, M390, M395, M470, M495, M570, M590, M595, M670, M690, M695, M4800, M4850, M5800, M5850
- FireboxV — Micro, Small, Medium, Large, Extra Large
- Firebox Cloud — Small, Medium, Large, Extra Large
Allocation from a WatchGuard MDR for Firebox license is specific to the Firebox model. When you allocate, reallocate, or deallocate a Firebox on an account that has WatchGuard MDR for Firebox allocated for the same model, the MDR allocation could also change. If you deallocate the only Firebox covered by the WatchGuard MDR for Firebox license, then the MDR license is removed from the account.
License Combinations and Restrictions
These coexistence rules apply to Subscriber accounts. For environments with both Endpoint Security and Microsoft Defender for Endpoint, you can allocate WatchGuard Core MDR and WatchGuard Core MDR for Microsoft in the same Subscriber account.
This table shows which core MDR products can coexist in the same Subscriber account.
| Product | WatchGuard Core MDR | WatchGuard Core MDR for Microsoft | WatchGuard Total MDR | WatchGuard Open MDR |
|---|---|---|---|---|
| WatchGuard Core MDR | Yes | Yes | No | No |
| WatchGuard Core MDR for Microsoft | Yes | Yes | No | No |
| WatchGuard Total MDR | No | No | Yes | No |
| WatchGuard Open MDR | No | No | No | Yes |
This table shows which MDR service add-ons can coexist with each Subscriber account configuration. The MDR Service Add-ons for WatchGuard Products Only (Standalone) row indicates that the Subscriber account can have an MDR service add-on for a WatchGuard product and no core MDR product.
| Subscriber Account Product | WatchGuard MDR for Endpoint Security | WatchGuard MDR for NDR | WatchGuard MDR for Firebox | WatchGuard MDR for AuthPoint | WatchGuard MDR for FireCloud | WatchGuard Open MDR 3rd Party Log Storage Service | WatchGuard MDR Vulnerability Scanner | WatchGuard VCISO for MDR |
|---|---|---|---|---|---|---|---|---|
| WatchGuard Core MDR | No | Yes | Yes | Yes | Yes | No | Yes | Yes |
| WatchGuard Core MDR for Microsoft | No | Yes | Yes | Yes | Yes | No | Yes | Yes |
| WatchGuard Total MDR | No | No | No | No | No | No | Yes | Yes |
| WatchGuard Open MDR | No | No | No | No | No | Yes | Yes | Yes |
| MDR service add-ons for WatchGuard products only (standalone) | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes |
License Types
There are these types of licenses:
Term Licenses
A term license has a set number of users and a set duration, or term. For example, you might purchase a license for 100 users that expires after three years. The license expires the day after the expiration date at 00 UTC.
Subscription Licenses
A subscription license enables you and your managed accounts to add users with no allocation limits. You can set a limit on the accounts you manage. With a subscription license, WatchGuard bills you monthly based on the number of users you have allocated. For more information, go to About Subscription Licenses in WatchGuard Cloud.
NFR Licenses (Service Providers only)
A Not for Resale license includes a set number of users and typically has a three-year term. NFR licenses are available to Service Providers only.
Allocation Types
When Service Providers allocate users from a license to their managed accounts, they select an allocation type which specifies how the managed account can use the users.
Term Allocation
When you allocate users as a term allocation, the managed account can allocate a specific number of users to an account for a set duration or term from a term license or MSSP points.
Subscription Allocation
When you allocate users as a subscription allocation, the managed account can allocate a specific number of users or an unlimited number of users . WatchGuard bills the account monthly based on the number of active users.
Linked to License
When you allocate users as Linked to License, the quantity and expiration date of the allocated users are linked to the quantity and expiration date of your term license.
For MDR service add-ons for WatchGuard products, the allocation type must match the allocation type of the related product. For example, if the managed account has an AuthPoint subscription allocation, you must use the Subscription allocation type for the WatchGuard MDR for AuthPoint add-on license.
Term License Activation
You can activate licenses on the Activate Licenses page on the WatchGuard website. For more information, go to Activate a WatchGuard MDR License.
After you activate a WatchGuard MDR license, you can review the activated licenses for your account in Support Center on the Managed Services page. To view the details and history of a license, click the license name.
Licenses work differently for WatchGuard Cloud Subscriber and Service Provider accounts.
Subscribers
Subscriber accounts can only have one product license. When a Subscriber account activates a new license key in the Support Center, it is used to modify the current active license. You can use a new license to add users or extend the license expiration.
Service Providers
Service Providers can have many product licenses. When a Service Provider activates a new license key, they can use it to modify an active license or add a new, separate license. After activation, the license appears in the Service Provider inventory in WatchGuard Cloud, but the expiration date of the license is tracked separately.
License Renewals
To renew a license or modify an existing license, you purchase a new license and activate it. When you activate the new license, you select whether to add users or extend your current license. When you add users to your active license or extend it, the new license merges with your active license and the two licenses are co-termed.
Co-terming consolidates or merges your term licenses to synchronize renewal dates. When you co-term licenses, a new expiration date is calculated based on the updated users count and the term length of the license you activated. If you add users, the number of users you purchased is added to your current inventory. For example, if you have 50 users and purchase a term license for 100 users, your final count after you activate your new license is 150 users.
If you have an active subscription license, when you renew a term license, your subscription usage count reduces automatically so that only the users in excess of your termed license are billed as subscription users.
When you extend your license, if you purchased the same number of users that you currently have, your license is extended for another period (one or three years). If you purchased more users than are in your current inventory, your inventory immediately updates to match the number of users you purchased the license for.
To renew with fewer users, purchase a license for the desired number of users and choose Extend License when you activate your license key.
When you renew the license for fewer users, we recommend that you do so close to your expiration date. If you activate the license key before your expiration date, your license count reduces immediately. This could limit the number of users available for your managed accounts and your account could become overallocated.
If you have an active subscription license, when you renew or upgrade a term license your subscription usage is automatically updated so that only the users in excess of your termed licenses are billed as subscription users.
License Expiration
WatchGuard MDR licenses expire the day after the expiration date at 00:00 UTC. After a license expires, there is a seven-day grace period. If you renew your license before the grace period ends, no further action is required. If you do not renew your license before the grace period ends:
- For WatchGuard Core MDR, the WatchGuard MDR team no longer monitors your licensed endpoints or Microsoft 365 environment.
- For WatchGuard Core MDR for Microsoft, the MDR team no longer monitors Microsoft Defender for Endpoint, and the associated data is deleted.
- For WatchGuard Total MDR and WatchGuard Open MDR, the MDR team no longer monitors your licensed endpoints or any of the supported optional environments included with the license.
- For MDR service add-ons for WatchGuard products that include monitoring, the MDR team no longer monitors the environments covered by those licenses.
- For all WatchGuard MDR licenses, access to the Managed Services portal is disabled.
If you are a Service Provider with different WatchGuard MDR licenses and one license expires, the managed services continue. After you renew your license, monitoring by the MDR team and access to the portal return for all affected endpoints.
Overallocation
Service Provider accounts could become overallocated when an account they manage allocates more users than there are available in the license. When a Service Provider account becomes overallocated, access to the Managed Services portal is no longer available.
To identify accounts that are over their limit, review Subscriber dashboards and audit logs. When an account is overallocated, we recommend that you reduce the number of allocated users (deallocate), or increase the number of users in the license. For more information on overallocation, go to Inventory Overallocation in WatchGuard Cloud.