Threat Detection and Response Planned Service Update

What’s new: 

ThreatSync is a WatchGuard Cloud service that provides XDR technology for WatchGuard Network and Endpoint Security products that: 

• Provides a UX primarily for incident responders 
• Displays malicious detections as incidents 
• Correlates events to create new malicious detections 
• Enables responders to respond on-demand or configure automated responses to malicious detections and abnormal behaviors 
• Has service provider capabilities including aggregated dashboards, automation templates, and email notifications 

ThreatSync provides extended detection capabilities by correlating data from different WatchGuard security products that indicate the presence of threat actors in the organization. By using multiple products and correlating activities monitored from different security products, ThreatSync scores and detects malicious scenarios that could be indicators of compromise (IoCs), enabling mean-time-to-detect (MTTD) reduction and swift containment of the impact, severity, and scope. 

How do I get ThreatSync?

ThreatSync is a WatchGuard unified security feature included by default with any Firebox Total Security Suite (TSS) subscription and WatchGuard Endpoint Protection, Detection and Response (EPDR) and Endpoint Detection and Response (EDR) products. The more WatchGuard products you have, the more visibility and expanded XDR features you gain access to. And deployment is as easy as it gets. You simply browse to a ThreatSync page and click Enable to get ThreatSync to start using the products you already own. 

What about TDR?

With the arrival of ThreatSync as the WatchGuard Cloud service that correlates network and endpoint data to detect new malicious activity, it is time to start to phase out the use of Threat Detection and Response (TDR). We recently released EDR Core as a replacement for the TDR Host Sensor to provide you with equivalent or superior capabilities to those you have with Threat Detection and Response today. In conjunction with that release, we will mark specific Threat Detection and Response features end-of-sale and end- of-life. 

Here is the full schedule for this transition:

Find out more For more information about ThreatSync, go to About ThreatSync in the Help Center.

What’s new:

WatchGuard is excited to announce the general availability of EDR Core and the associated migration tool. The release of EDR Core further realizes our Unified Security vision by providing TDR functionality using Panda technology and the WatchGuard Cloud native XDR solution, ThreatSync (currently in Beta). Highlights of the new improvements based on WatchGuard Endpoint Security functionality include: 

1. Improved Threat Intelligence and Heuristics 
2. Improved Anti-tampering protection 
3. Contextual Detections and Anti-exploit technology (for fileless malware) 
4. Indicators of Attack (visible in ThreatSync only) 

Does this affect me?

EDR Core licenses are included with every Total Security Suite license with a WatchGuard Firebox. All accounts with existing TDR Host Sensor licenses now have equivalent EDR Core licenses added in WatchGuard Cloud.

How do I upgrade?

We have provided a migration tool that facilitates the transition from the TDR Host Sensor to EDR Core. The tool is available from the Administration menu in WatchGuard Cloud. After you follow the prompts on the screen and click Upgrade, all your TDR Host Sensors will automatically upgrade to the WatchGuard Endpoint Agent the next time they connect to the cloud.  All accounts can use TDR Host Sensors and EDR Core simultaneously, during migration.  

Upgrading to a WatchGuard Endpoint Security product later will be easy because the agent used for EDR Core is the same as other WatchGuard Endpoint Security products. Simply activate a license for the new Endpoint Security product and the WatchGuard Cloud UI will automatically convert to the new product. There is no need to redeploy the agent.   

Find out more

For more information, please refer to the Introduction to EDR Core document, the EDR Core documentation in WatchGuard Help Center and the EDR Core FAQ.  

Contact
For Sales or Support questions, you can find phone numbers for your region online. If you contact WatchGuard Technical Support, please have your registered appliance Serial Number or Partner ID available.

Dear Valued Partners,

Starting 13 February 2023, the TDR Host Sensor will upgrade to version 6.0.5.9812 to make sure it can continue to communicate with the cloud. If a Host Sensor does not upgrade to the latest version by 22 February 2023, the Host Sensor will stop communication with the cloud. If this occurs, TDR will no longer perform detections and responses, and ransomware hash lists will not update for new threats.

What should you do?
The upgrade will be done automatically, so you only have to make sure your computers with Host Sensors installed are online to perform the automatic update to version 6.0.5.9812. If you need to install the latest Host Sensor version manually, you can download it from the Software Downloads page (https://software.watchguard.com/).

What are the next steps?
We will soon release a WatchGuard Cloud feature that enables you to migrate TDR Host Sensors to WatchGuard EDR Core, which supports the new ThreatSync service. If you want to run this migration but do not first upgrade your Host Sensors to the latest version, they cannot contact the cloud to update to EDR Core after 22 February 2023.

Please contact your WatchGuard Sales team if you have any additional questions about this upgrade. We will continue to communicate more information as we get closer to the release date.

The WatchGuard Team