WatchGuard Blog: WatchGuard Cloud Platform

ThreatSync requires a new version of WatchGuard Endpoint Security by 31 August 2023

Ricardo Arroyo — Thu, 27 Jul 2023 13:06:56 -0700

Good day!

I first want to thank everyone who enabled ThreatSync over these crucial first four months. Early adopters are instrumental in helping us determine the future direction of the product. Thanks to this initial feedback, we have been able to improve ThreatSync’s ability to reflect the status of your Watchguard Endpoint Security (WES) devices.

Does this affect me?

We have an improvement that now reflects isolations that previously occurred in the Endpoint Security management UI within ThreatSync. This required a significant change to the system to enable ThreatSync to more effectively interact with Endpoint Security. This also requires an update to the Windows Endpoint agent. After we deploy these changes, all accounts must run WatchGuard Endpoint Security Release 15 (R15) for ThreatSync to continue functioning as expected.

How do I upgrade?

To opt in to the Endpoint Security upgrade, use the Alert Bell in the management UI. This upgrade requires a restart of the endpoints to update to the improved protection provided by R15. If you want to make sure you are ready for the ThreatSync update, make sure each endpoint is running Windows agent version 1.21.02. Go to the link below for more details and screen captures.

When is the deadline to upgrade?

We will enable this Endpoint status feature in ThreatSync on 31 August 2023.

What happens if I do not upgrade?

If you have not upgraded by the deadline, we cannot guarantee that ThreatSync will continue to reflect isolation status accurately.

For more information, go to: WatchGuard Endpoint Security Upgrade.

End of Life Timeline for TDR starting 30 September 2023

Ricardo Arroyo — Mon, 17 Jul 2023 11:45:07 -0700

Greetings!

We are 10 weeks away from the end-of-life (EOL) date of our Threat Detection and Response service on 30 September 2023. As this date approaches, it is important to understand how the EOL may affect you.

Threat Detection and Response (TDR) end-of-life timeline:

30 September 2023 – The TDR user interface in WatchGuard Cloud will no longer be available and therefore the Threat Detection options in the Monitor or Configure menus are not visible. The Host Sensor License pages are also not visible on the Inventory menu. TDR Host Sensors will continue to function, but you will no longer be able to view or remediate indicators, or generate reports. Your ability to upgrade Host Sensors to WatchGuard Endpoint Security from WatchGuard Cloud remains enabled.
28 October 2023 – WatchGuard will automatically uninstall heart beating Host Sensors that have not upgraded to WatchGuard Endpoint Security.
1 December 2023 – The TDR service ceases to function and any remaining Host Sensors must be uninstalled manually.

For customers who use Panda-branded endpoint security products:

If you use the TDR Host Sensor in conjunction with Panda Adaptive Defense or AD360, the protection previously provided by TDR will continue with your active Panda AD and AD360 deployments.
If you use the TDR Host Sensor in conjunction with Panda EPP, we recommend upgrading to Panda AD360 to maintain your current level of protection. Please talk to your Sales representative about eligibility for a one-time discount on upgrade.
Although visibility into TDR detections is discontinued, the protection is still provided by your Panda endpoint security product. Once you migrate from Panda products to WatchGuard Endpoint Security, you can start to use ThreatSync in WatchGuard Cloud, which offers visibility into incidents and remediations.

For customers who use WatchGuard Endpoint Security products:

If you use the TDR Host Sensor in conjunction with WatchGuard EDR or EPDR, the protection previously provided by TDR will continue with your active EDR and EPDR deployments.
If you use the TDR Host Sensor in conjunction with WatchGuard EPP, we recommend upgrading to WatchGuard EPDR to maintain your current level of protection. Please talk to your authorized WatchGuard representative about eligibility for a one-time discount on an upgrade.
Once EDR or EPDR is activated, you can enable ThreatSync. This new XDR product in WatchGuard Cloud replaces TDR and is our XDR platform moving forward.

For customers who do NOT use one of our endpoint products:

Use the upgrade tool available in WatchGuard Cloud to upgrade from the TDR Host Sensor to WatchGuard Endpoint Security. If you are a WatchGuard Firebox customer and never purchased WatchGuard Endpoint Security, your TDR Host Sensor licenses have already been converted to EDR Core licenses.
For more information about the upgrade process, consult the Host Sensor upgrade to Endpoint Security. page.

For previous announcements, go to:

Please reach out to your authorized WatchGuard representative for answers to any remaining questions. Thank you.

The WatchGuard Product team

Beta is open for ThreatSync, WatchGuard's XDR solution - $100 Giveaway

Ricardo Arroyo — Thu, 05 Jan 2023 10:09:30 -0800

ThreatSync is a new WatchGuard Cloud service that provides XDR technology for WatchGuard Network and Endpoint Security products that:

Provides a UX primarily for incident responders
Displays malicious detections
Correlates events to create new malicious detections
Delivers the ability to respond on-demand or automate the response to malicious detections and abnormal behaviors
Has Service Provider capabilities including aggregated dashboards, automation templates, and email notifications

ThreatSync provides extended detection capabilities by correlating data from different WatchGuard security products that indicate the presence of threat actors in the organization. By using cross-domain and correlating activities monitored from different security products, ThreatSync scores and detects malicious scenarios that could be indicators of compromise (IoCs), enabling MTTD reduction and swift containment of the impact, severity, and scope.

ThreatSync is a WatchGuard unified security feature included by default with any Firebox TSS subscription and WatchGuard EDPR and EDR products. The more WatchGuard products you have, the more visibility and expanded XDR features you gain access to.

Before you submit your feedback, make sure to review the list of Known Issues.

For more details on ThreatSync, please visit the Beta site.

We will be holding a raffle at the end of the Beta window to give away 10 - $100 Visa Gift cards. In order to be eligible you have to complete at least 10 Beta Tasks and provide at least one piece of feedback, which can be a Bug, Suggestion or Praise. We're very excited to hear from everyone so get those testing tasks and feedback in!

Again, we appreciate your help in beta testing this new product. Thanks for your help in making our products better!

The WatchGuard Beta Team

IMPORTANT NOTE: ThreatSync does not currently respect WatchGuard Cloud Account Groups. If you are currently using Account Groups to restrict certain operators to visibility of specific accounts, those restrictions will not work in ThreatSync and those restricted operators will see all Incidents for all child accounts. If you use Account Groups for this purpose we do not recommend you participate in this Beta at this moment.

Maintenance on WatchGuard Cloud

Brendan Patterson — Fri, 08 Apr 2022 11:16:27 -0700

Maintenance on WatchGuard Cloud
Later today, 8th April 2022 at 11:30 pm UTC we will be performing maintenance on WatchGuard Cloud that may cause inability to log into WatchGuard Cloud.

When: 8th April 2022 at 11:30 pm UTC
Maintenance Window: Approximately 2 hour
Service Interruptions: Approximately 1 hour (~ 11.30 PM UTC to 12.30 AM UTC)
Impact: During the maintenance window, you may experience inability to log into WatchGuard Cloud. Existing sessions should not be affected. We expect these service interruptions to be less than one hour.

Maintenance updates and status of the service can be tracked at https://status.watchguard.com/

We also publish notices about future maintenance updates in the WatchGuard Cloud pop-up notifications, which are also available in the console under the Administration / Notifications / Announcements menu.

Organize and Secure Accounts with Account Groups in WatchGuard Cloud

Stephen Helm — Tue, 08 Jun 2021 12:52:08 -0700

Account Groups are now available in WatchGuard Cloud

WatchGuard Cloud’s newest platform feature, Account Groups, enables service providers to create groups with their existing managed accounts. Account groups can be used to assign operator permissions. On the Account Groups page, Account Groups are represented by folders you can add, delete, and move to organize your accounts. By default, a service provider’s My Account cannot be sorted into an account group and is only visible to operators with permissions to all accounts. Account groups created in WatchGuard Cloud are also available in Service Provider Endpoint Manager where you can quickly apply endpoint policies to groups of accounts.

Benefits of Account Groups

Quickly organize accounts into folders based on customer characteristics that make sense for your business
Apply different endpoint policies to Account Groups based on the customer’s security needs
Restrict Helpdesk and Auditor operators to see only the accounts you choose (for example: restrict Helpdesk and Auditor operators from seeing activity on your My Account)

Service providers with an Owner role can now restrict access for operators with Helpdesk and Auditor roles to specific groups of managed accounts. This allows service providers to easily keep their managed accounts organized, while also restricting their operators to only the necessary accounts.

To get started with Account Groups, navigate to Administration > Account Groups in WatchGuard Cloud.

Keep Up with What’s New in WatchGuard Cloud

WatchGuard regularly updates and improves on the WatchGuard Cloud platform. To learn more about the developments to WatchGuard Cloud, please refer to the “What’s New In WatchGuard Cloud” presentation, and most recent Release Notes.

WatchGuard Integrates with Autotask PSA to Simplify Managed Security Services

Himanshu Verma — Wed, 08 Nov 2017 09:09:12 -0800

Available with Fireware 12.0.1, WatchGuard has introduced a leading integration with Autotask to simplify managed security services for our global base of mutual Channel Partners. Managed security service providers (MSSPs) using WatchGuard and Autotask can now benefit from closed-looped service ticketing and synchronization of their customers’ asset Information.

Key Features

Integrated, Closed-Loop Service Ticketing — Track Issues with Service Ticketing Made Easy

Enable Autotask service tickets for WatchGuard security solutions.
Configure event thresholds on a wide range of parameters identified per device, including: security services, device statistics, and subscription statuses. Event thresholds automatically trigger the creation and closure of service tickets, closing tickets when issues are resolved, and reducing the number of false alarms.
Eliminate ticket flooding and provide trending visibility into customer security, because the same ticket reopens if the issue returns, rather than creating multiple tickets.

Auto Synchronization of Asset Information — Know a Customers’ Security

Automatically register and update customer security asset information.
Gain visibility into customer security through automated synchronization with WatchGuard security appliances, including subscription start and end dates, device serial numbers, OS versions, and more.
Avoid a managed network going unprotected because of incorrect security service subscription end dates.

Learn more about this integration by visiting our Autotask Integration page, which includes links to an integration guide, demo video, and a solution brief. To view all of our available Technology Partner integrations, visit our Technology Integrations page.

Now Available: MSSP Command

Himanshu Verma — Wed, 14 Jun 2017 16:18:57 -0700

WatchGuardONE partners who are enrolled as an MSSP Partner, can now access the new MSSP Command tool, which is available from the WatchGuard Partner Portal Tools navigation. This new tool has replaced the previous MSSP Dashboard to provide easier management and greater visibility into your Monthly Flexible Points business for MSSP devices.

Improved User Experience:

MSSP Command offers a completely revamped user interface that is easy to use and navigate, whether you are wanting to know more about your MSSP business through interactive charts and diagrams, quickly apply changes to point allocations across all your customers’ devices, or configure settings for automatic alerts and notifications.

Improved Manageability:

MSSP Partners can now easily navigate to multiple Firebox devices and manage monthly security services from once easy-to-manage interface. They can also assign customer names to each device to quickly identify and find devices. We have now also introduced a data export feature that allows you take the information on the go for offline reporting.

Improved Visibility:

A new points gauge is available at the top of each page that provides MSSP Partners with full visibility into total points allocated and required for ongoing monthly services. In addition to the required points, this tool also provides visibility into points available, points used in the current month, and the points that will be used next month. From an interactive dashboard, you are able to see your trending points usage for the past year, your service type allocation across all customers, the number devices and device types across customers, as well alerts and notifications regarding points usage.

Online Help Resource:

The new tool also includes an online help resource.

MSSP Command is a single point of access for WatchGuardONE Managed Security Services Providers (MSSPs) who have enrolled in the flexible pricing option. MSSP Command provides MSSP partners the benefits of a distributed investment, the ability to manage security services on a monthly basis, and the ability to change services on-demand for their customers.

All WatchGuardONE Partners have the ability to enroll as an MSSP Partner and begin using this new tool today to leverage our MSSP Flexible Pricing option. To become a WatchGuardONE MSSP Partner, Partners can contact WatchGuard sales representative, or complete and submit the WatchGuardONE MSSP Partner Enrollment form and a WatchGuard representative will contact them directly.