WatchGuard Cloud Detection and Response Release Notes

New Features

Integration with ConnectWise PSA On-Prem

CloudDR now supports integration with ConnectWise PSA On-Prem. For more information, go to ConnectWise PSA On-Prem Integration with WatchGuard Cloud in Help Center.

Threat Response Guide

On the details page for a specific threat rule, when you select an actor on the Threats tab, a new Respond tab includes a guide to that enables you to manually respond to the threat, including quick response actions and threat reporting.

Autofix Automation for Threat and Issue Remediation

On the Threats > Rules page, you can now click the Autofix icon for a rule when it is available. Autofix operations enable you to resolve security issues in your cloud application from CloudDR.

You can also add automation to automatically trigger an autofix action to run when an issue or a threat triggers a rule. Automation is useful to start remediation without the need for manual interaction. For more information, go to Add Autofix Automation for Issues in Help Center.

Enhancements

• This release includes new threat rules:
  • User Account MFA Disabled (Microsoft 365, Okta, and Atlassian)
  • Mass Data Modification (Microsoft 365)
• The Service Account Login threat rule was updated to also check for failed login attempts.

Resolved Issues

• Minor updates and bug fixes.

Resolved Issues

• This release includes internal maintenance and stability improvements.

Enhancements

• CloudDR is now iframed in the WatchGuard Cloud user interface. To open the CloudDR management UI, select Monitor > CloudDR or Configure > CloudDR. When you select an account from Account Manager, the selected account shows as the organization in CloudDR.
• This release improves the creation, display, and restriction of remediations. It also makes autofix behavior more consistent with issue state and application context. [DEV-6449]

Resolved Issues

• This release resolved an issue related to Dropbox discovered applications. Applications will now be assigned to users who have consented to them. Additional discovered application rules were added. [DEV-6481]
• This release resolved an issue to make sure that files are no longer visible when sharing is removed. [DEV-6476]
• This release resolved an issue where the issues rule, Role Based Chat Permissions is Not Disabled, identified a false positive.The rule was also renamed to Role Based Chat Permissions is Not Enabled. [DEV-6454]
• This release resolved an issue where the issues rule, Sync Button on Storage is Not Hidden from Users, identified a false positive. [DEV-6507]
• Minor updates and bug fixes. [DEV-6439, DEV-6489, DEV-6514]

New Features

Integration with AWS IAM

CloudDR now supports integration with AWS IAM.

Enhancements

• This release includes the addition of new discovered application rules.

Resolved Issues

• When Dropbox is a discovered, the application is now assigned to users who consented to use it.
• Minor updates and bug fixes.

Enhancements

• Delegated accounts in WatchGuard Cloud with a CloudDR license now show with managed accounts in the Organization pane.

Resolved Issues

• Integrations with Microsoft 365 no longer report false positives for these rules:
  • Ensure that no sender domains are allowed for anti-spam policies - Fix for false positive results
  • Don't add allowed IP addresses in the connection filter policy - Fix for false positive results
• Minor updates and bug fixes.

Enhancements

• A new icon now shows to indicate when actions and autofix operations are available to complete directly in the management UI. Autofix operations enable CloudDR to make requests in the application to automatically resolve the issue. You can view the new icon on the issues page for a category of inventory and on the Rules > Use Cases > Issues page.

Resolved Issues

• A fix was included to resolve an issue where CloudDR only included users who were classified as Members or Guests in Microsoft 365. When users are created in Entra and the UserType field is not set as Member or Guest, those users now appear in the CloudDR user inventory. [DEV-6241]
• A fix was included to report the correct permission for shared files in Microsoft 365. When a file is shared within the organization, it is no longer reported as being shared publicly. [DEV-6415]
• Minor updates and bug fixes.

Enhancements

• In the Allocations API, the productName parameter now supports Cloud_DR as a product name in all allocation endpoints. For more information, go to Allocations API in the WatchGuard API Help.

New Features

• Initial release of WatchGuard Cloud Detection and Response. For more information, go to CloudDR Help.