Skip to main content
WatchGuard EDR is currently in beta
WatchGuard EDR connects to Wirespeed through the WatchGuard Cloud public API. Wirespeed polls Endpoint Security security events (malware, exploits, indicators of attack, and more), synchronizes the device inventory, and can isolate devices from the network. This integration covers WatchGuard Endpoint Security products managed in WatchGuard Cloud, such as WatchGuard EDR, EPDR, and Advanced EPDR. For Firebox firewall logs, use the WatchGuard Firebox integration.

​
Prerequisites

  • A WatchGuard Cloud operator role that can view and enable API access on the Managed Access page
  • A WatchGuard Endpoint Security license on the account whose devices Wirespeed should monitor

​
Enable API access in WatchGuard Cloud

WatchGuard documents these steps in its Authentication API and Endpoint Security Management API guides.
  1. Log in to WatchGuard Cloud.
  2. Navigate to Administration > Managed Access.
  3. Enable API access if it is not already enabled.
  4. Copy the API Key.
  5. Copy the read-write Access ID and set or copy its Password.
  6. Note the region in the API URL shown on the page, for example api.usa.cloud.watchguard.com. The region is usa, deu, or jpn.
Wirespeed needs read-write credentials to isolate devices. To use read-only credentials, enable Read Only (Not Recommended) under the advanced options when you add the integration. Wirespeed then ingests events and devices but cannot isolate endpoints.

​
Find the account ID

The account ID identifies the WatchGuard Cloud account whose devices belong to the Wirespeed team, for example WGC-1-123abc456 or ACC-1234567. In WatchGuard Cloud, open Administration > My Account and copy the Account ID.

​
Service providers

A WatchGuard Cloud Service Provider can connect each managed account with its own API credentials:
  1. Use the Service Provider account’s Access ID, Password, and API Key.
  2. Enter the managed account’s ID as the account ID, not the Service Provider’s.
  3. Create one Wirespeed integration per managed account.
Wirespeed requests a token scoped to the managed account through the WatchGuard Cloud Authorization API. Setup fails if the Service Provider does not manage that account.

​
Add the integration in Wirespeed

  1. In Wirespeed, navigate to Integrations > Add Integration > WatchGuard EDR.
  2. Enter the Region: usa, deu, or jpn.
  3. Enter the Access ID, Password, and API Key.
  4. Enter the Account ID.
  5. Submit the integration.
On connect, Wirespeed requests an access token, then reads the account’s licenses, one device, and the malware security events. Setup fails if any of these requests is rejected.

​
Response actions

Wirespeed can isolate and unisolate WatchGuard-managed devices. Isolated devices display a message saying that your security team isolated the device from the network.

​
Current limitations

  • Detection categorization remains non-escalating until WatchGuard EDR WDC rules are defined.