About ThreatSync

Correlation

ThreatSync gathers security event data from multiple security products to identify and group related events into single incidents. This data correlation provides Incident Responders with a contextualized view of a threat or attack, and enables them to respond to actionable incidents. ThreatSync correlates data from these WatchGuard security products:

• Fireboxes
• Access points
• WatchGuard Endpoint Security
• Advanced Endpoint Protection Detection and Response (Advanced EPDR)
• Endpoint Protection Detection and Response (EPDR)
• Endpoint Detection and Response (EDR)
• Endpoint Detection and Response Core (EDR Core)
• AuthPoint
• AuthPoint Multi-Factor Authentication
• AuthPoint Total Identity Security

ThreatSync uses these events for correlation:

• Advanced Persistent Threats (APTs) detected in the network and found on an endpoint or Firebox
• Malware detected in the network and found on an endpoint or Firebox
• Malicious network connection correlated to an endpoint process or Firebox
• Malicious access points (Rogue, Suspected Rogue, and Evil Twin) detected by Airspace Monitoring on access points managed by WatchGuard Cloud
• Credential Access events detected by AuthPoint

Incidents

The ThreatSync management UI presents correlated events as incidents for you to review and manage. An incident is activity that is confirmed to be malicious, and can be as simple as an indicator of compromise, or as complex as an indicator of attack that sequences behaviors to determine malicious intent. For more information, go to Incident Types and Triggers in ThreatSync.

Entities of Interest

In ThreatSync, entities of interest are the unique objects related to an incident. Entities of interest can include IP addresses, URLs, files, users, endpoints, and devices. On the Incident Details page, the Entities of Interest section provides a list of the unique objects related to the incident, and the available actions for each entity. This information provides context to Incident Responders when they review and respond to incidents. For more information, go to Entities of Interest for Incidents in ThreatSync.

Signals

The ThreatSync management UI presents the events and data that combine to form an incident as signals. You can review the signals associated with an incident on the Incident Details page. For more information, go to Signals for Incidents in ThreatSync.

Signal Sources

In ThreatSync, signal source refers to the original detection point that identified a security event and sent it to ThreatSync to create the incident. ThreatSync supports these signal sources: Fireboxes, endpoints, AuthPoint, access points, and ThreatSync+.

Risk Scores and Risk Levels

ThreatSync assigns risk scores and risk levels to incidents, endpoints, and users to help Incident Responders identify issues and prioritize responses in their networks. ThreatSync calculates risk scores on a scale of 1 to 10. The higher the score, the higher the risk.

• Incident Risk Score and Level — Incident risk score indicates the severity of an incident. ThreatSync automatically assigns each incident an incident risk score on a scale and corresponding level that appears on the Monitor > Summary and Monitor > Incidents pages. For more information, go to Incident Risk Scores and Risk Levels in ThreatSync.
• Endpoint Risk Score and Level — ThreatSync automatically assigns each endpoint a risk score and corresponding risk level that appears on the Monitor > Endpoints page. ThreatSync determines the risk score for an endpoint based on the incident risk scores associated with the endpoint in the past 30 days. For more information, go to Endpoint Risk Scores and Risk Levels in ThreatSync.
• User Risk Score and Level — ThreatSync automatically assigns each user a risk score and corresponding risk level that appears on the Monitor > Users page. ThreatSync determines the risk score for a user based on the risk scores for open incidents associated with that user. For more information, go to User Risk Scores and Risk Levels in ThreatSync.

Response Actions

In ThreatSync, there are two ways to respond to incidents:

• Manual Actions Performed by a User — As you monitor threats detected by ThreatSync and review incident details, you might decide to take a manual action to respond to the incident, or to reverse an action taken automatically by a WatchGuard product or service. For example, you might block an IP address, delete a malicious file, block an access point, or isolate a computer.
  When you review an incident, you can manually perform actions from various locations in the ThreatSync management UI.
  For more information, go to Perform Actions in ThreatSync.
• Actions Performed Automatically by an Automation Policy — You can configure automation policies to automatically perform actions on incidents that meet the conditions you define. For example, you could create an automation policy to automatically delete files associated with a specific type of incident with a risk score of 9 or 10.
  Automation policies enable Incident Responders to focus on the review of incidents that might require manual responses. Service Providers can use automation policy templates to assign multiple policies to the accounts or account groups they manage.
  For more information, go to About ThreatSync Automation Policies.