WatchGuard Managed Services Release Notes

New Features

WatchGuard MDR Vulnerability Scanner

A new WatchGuard MDR Vulnerability Scanner add-on license is now available. This license provides Vulnerability Management capabilities that help you identify and assess vulnerabilities across your environment. You can scan your internal and external network to identify open ports, exposed services, missing patches, end-of-life software, weak or default credentials, and other exploitable misconfigurations.

WatchGuard MDR Vulnerability Scanner requires an active WatchGuard Core MDR, Core MDR for Microsoft, Total MDR, or Open MDR license on the same Subscriber account. Each licensed tenant includes one scan per month. The number of IP addresses in your scan ranges cannot exceed the number of IP addresses included in your Vulnerability Scanner license.

For more information, go to Configure WatchGuard MDR Vulnerability Scanner, Review Vulnerability Scan Results, and About WatchGuard MDR Licenses in Help Center. [MSRD-8010]

Enhanced Monthly Report

Starting with the October 2026 monthly reporting period, an updated WatchGuard MDR Monthly report now summarizes security activity and service outcomes for the reporting month. Results are scored against WatchGuard recommended targets and include an executive summary, KPIs, detection and response metrics, vulnerabilities, hygiene, and outcomes by product.

For the Monthly Report, you can select the report language. This option does not apply to Weekly Reports. Service Providers can also add their company logo to the Monthly Report.

For more information, go to View MDR Reports and Manage MDR Report Settings in Help Center. [MSRD-6637]

New Subscriber Dashboard

For Subscribers, the Managed Services portal Dashboard now shows a rolling 90-day overview of your WatchGuard MDR posture. The updated Dashboard includes an overview with connection and investigation summaries, posture tiles for Connections, Threat Detection, Investigations, and Vulnerabilities, and trend tiles for endpoints, detections, investigations, and vulnerabilities. Click a tile to open related details. The data you see depends on your WatchGuard MDR license.

For more information, go to Managed Services Portal Dashboard in Help Center. [MSRD-6634]

New Features

FireCloud Integration with WatchGuard MDR

WatchGuard MDR now supports FireCloud as a data source. For accounts with a FireCloud license and a WatchGuard Total MDR or WatchGuard Open MDR license, WatchGuard MDR automatically ingests FireCloud detections for monitoring and investigation. This integration provides broader visibility across your environment and helps security analysts identify and respond to threats more effectively.

For more information, go to Review MDR Detections in and About FireCloud in Help Center. [MSRD-6672]

Enhancements

• When you add the MDR integration with Microsoft 365 in the Managed Services portal, Microsoft 365 content types are automatically enabled. For more information, go to Connect WatchGuard MDR with Microsoft 365 in Help Center. [MSRD-7680]

Resolved Issues

• The endpoint count on the Service Status page in the Managed Services portal now shows only endpoints that are integrated with Microsoft Defender for Endpoint and actively sending data to MDR. To provide accurate and consistent visibility into the active Defender for Endpoint environment, the count is based on data reported through the supported API and represents only endpoints that are currently monitored. [MSRD-7571]

New Features

Improved Onboarding for WatchGuard MDR

Partners and customers can now get started with WatchGuard MDR directly from WatchGuard Cloud. The improved onboarding experience reduces setup time and simplifies the initial configuration.

For more information, go to Get Started with WatchGuard MDR in Help Center. [MSRD-2761]

Enable MDR Service Access for a Managed Account

Tier-1 Service Providers can now delegate management of the MDR service settings in the Managed Services portal to the administrator for a Subscriber account or owner of a Service Provider account they manage. This allows the tier-n Subscriber or Service Provider of the account to manage their account settings and integrations in the Managed Services portal. For more information, go to MDR Service Access Management in Help Center. [MSRD-7282]

Enhancements

• You can now manage MDR report recipient options on the new Report Settings page. For more information, go to Manage MDR Report Settings in Help Center.

New Features

Duo Integration with WatchGuard Open MDR

WatchGuard Open MDR can now ingest Duo authentication and administrator telemetry to deliver identity‑focused threat monitoring. It detects suspicious login activity, MFA bypass attempts, and other abnormal access patterns, and correlates Duo events with SaaS signals to strengthen detection accuracy. The service sends automated notifications for these detections, operates in monitor‑only mode, and does not enforce blocks or MFA resets.

For steps to configure Duo Security application protection and add the integration in the Managed Services portal, go to Duo Integration with WatchGuard Open MDR in Help Center. [MSRD-6703]

Enhancements

• When you allocate users from a WatchGuard MDR license, the WatchGuard MDR team is now automatically granted access to the account to provide managed detection and response services. For more information, go to Manage MDR Team Access to WatchGuard Cloud Accounts in Help Center. [WCD-28493]

Enhancements

• In the Managed Service portal, on the Onboarding > Integrations page, a new Add Integration dialog box is now available for WatchGuard MDR integrations with Microsoft 365, AWS CloudTrail, Google Workspace, and Okta. This enhancement streamlines configuration steps in the Managed Services portal. For more information, go to Connect WatchGuard MDR with Microsoft 365, Connect WatchGuard MDR with AWS CloudTrail, Connect WatchGuard MDR with Google Workspace and Okta Integration with WatchGuard Open MDR in Help Center. [MSRD-6607]

Resolved Issues

• In the Managed Services portal, on the Onboarding > WatchGuard Agent page, the Status column in the Endpoints with WatchGuard Agent now shows the correct status. [MSRD-6934]

New Features

WatchGuard Open MDR

A new WatchGuard Open MDR license is now available. With this license, MDR monitors your endpoints licensed with one of the Advanced EPDR, EPDR, or EDR Endpoint Security products.

WatchGuard Open MDR can also monitor WatchGuard Fireboxes (with a Total Security Suite license), ThreatSync+ NDR, and user authentications for AuthPoint Multi-Factor Authentication and AuthPoint Total Identity Security.

For third-party cloud integrations, WatchGuard Open MDR can monitor Microsoft 365, Microsoft Defender, AWS CloudTrail, AWS and Azure Cloud Security Posture Management (CSPM) environments, Google Workspace, CrowdStrike EDR, and Okta.

For more information about WatchGuard Open MDR, go to About WatchGuard MDR Licenses in Help Center.

In addition, the WatchGuard Open MDR can collect and monitor syslog data from many third-party firewalls.

For more information about third-party firewall monitoring, go to Configure Third-Party Firewall Syslog Collection for WatchGuard Open MDR in Help Center.

For more information about Okta and CrowdStrike integrations, go to Okta Integration with WatchGuard Open MDR and CrowdStrike EDR Integration with WatchGuard Open MDR.

New Features

Service Provider Dashboard

A new dashboard in the Managed Services portal gives Service Providers a consolidated view of data across all their managed accounts.

For more information, go to Managed Services Portal Dashboard in Help Center.

AWS and Microsoft Azure Cloud Security Posture Management CSPM Integration

If you have a WatchGuard Total MDR license, you can now integrate WatchGuard MDR with AWS CSPM and Microsoft Azure CSPM to combine threat detection and cloud security optimization for your AWS and Azure environments.

For more information, go to AWS Cloud Security Posture Management (CSPM) with WatchGuard MDR or Microsoft Azure Cloud Security Posture Management (CSPM) with WatchGuard MDR in Help Center.

Resolved Issues

• In the Managed Services portal, the Detections page now shows ThreatSync+ NDR details for APAC customers with WatchGuard Total MDR. [MSRD-6134]
• In the Managed Services portal, the Service Status page now shows Firebox and AuthPoint data for APAC customers with WatchGuard Total MDR. [MSRD-6128]

Enhancements

• If you have the WatchGuard Core MDR module allocated to an account with an Endpoint Security product, when you allocate users to the account from a WatchGuard Total MDR license, WatchGuard Core MDR allocations are now automatically removed. [ITDIGIT-17005]
• In the Managed Services portal, Service Providers can now select managed accounts they want to view from a multi-tier hierarchy in the tenant drop-down list. [MSRD-2708]

New Features

WatchGuard Total MDR

A new WatchGuard Total MDR license is now available. For environments that use one of the Advanced EPDR, EPDR, or EDR Endpoint Security products, WatchGuard MDR can monitor your licensed endpoints and other WatchGuard products, such as Fireboxes, AuthPoint, ThreatSync, and ThreatSync+ NDR. WatchGuard MDR can also monitor third-party cloud integrations that include Microsoft 365, AWS CloudTrail, and Google Workspace.

In the Managed Services portal, you can now go to Connections > Service Status to see a real-time overview of connected endpoints, network devices, cloud services, and AuthPoint users managed by WatchGuard MDR.

For more information about WatchGuard Total MDR, go to About WatchGuard MDR in Help Center.

Enhancements

• In the Managed Services portal, you can now go to Connections > Endpoints to view all connected endpoints that send data to WatchGuard MDR. This includes endpoints that run WatchGuard Endpoint Security or Microsoft Defender. [MSRD-2748]

Enhancements

• For environments with WatchGuard Core MDR and WatchGuard Core MDR for Microsoft, you now add recipients for weekly or monthly MDR reports in the Managed Services portal Tenant Settings page. For more information, go to MDR Reports in Help Center.
• The Monthly Summary Report sent by the SOC team now includes all closed Investigations related to potential security activity that was identified for that period.

New Features

WatchGuard Core MDR for Microsoft

A new WatchGuard Core MDR for Microsoft license is now available. With this license, the WatchGuard SOC can monitor and respond to threats on endpoints that run Microsoft Defender.

For more information about WatchGuard Core MDR for Microsoft, go to About WatchGuard MDR in Help Center.

Managed Services Portal

You can now view dashboards, activity, and reports for WatchGuard MDR in the Managed Services Portal. To open the portal, from WatchGuard Cloud, select Configure > Managed Services or Monitor > Managed Services.

For more information about the Managed Services Portal, go to About the Managed Services Portal in Help Center.