> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# WatchGuard EDR

> Ingest WatchGuard Endpoint Security events, synchronize devices, and isolate endpoints

> [!NOTE]
>
> WatchGuard EDR is currently in **beta**

WatchGuard EDR connects to Wirespeed through the WatchGuard Cloud public API. Wirespeed polls Endpoint Security security events (malware, exploits, indicators of attack, and more), synchronizes the device inventory, and can isolate devices from the network.

This integration covers WatchGuard Endpoint Security products managed in WatchGuard Cloud, such as WatchGuard EDR, EPDR, and Advanced EPDR. For Firebox firewall logs, use the [WatchGuard Firebox](https://docs.wirespeed.co/integrations/watchguard-firebox.md) integration.

## Prerequisites

* A WatchGuard Cloud operator role that can view and enable API access on the **Managed Access** page
* A WatchGuard Endpoint Security license on the account whose devices Wirespeed should monitor

## Enable API access in WatchGuard Cloud

WatchGuard documents these steps in its [Authentication API](https://www.watchguard.com/help/docs/API/Content/en-US/api_get_started/authentication.html) and [Endpoint Security Management API](https://www.watchguard.com/help/docs/API/Content/en-US/endpoint_security/WES_endpoint_security/v1/WES_endpoint_security.html) guides.

1. Log in to [WatchGuard Cloud](https://cloud.watchguard.com/).
2. Navigate to **Administration** > **Managed Access**.
3. Enable API access if it is not already enabled.
4. Copy the **API Key**.
5. Copy the read-write **Access ID** and set or copy its **Password**.
6. Note the region in the API URL shown on the page, for example `api.usa.cloud.watchguard.com`. The region is `usa`, `deu`, or `jpn`.

> [!NOTE]
>
> Wirespeed needs read-write credentials to isolate devices. To use read-only credentials, enable **Read Only (Not Recommended)** under the advanced options when you add the integration. Wirespeed then ingests events and devices but cannot isolate endpoints.

## Find the account ID

The account ID identifies the WatchGuard Cloud account whose devices belong to the Wirespeed team, for example `WGC-1-123abc456` or `ACC-1234567`. In WatchGuard Cloud, open **Administration** > **My Account** and copy the **Account ID**.

### Service providers

A WatchGuard Cloud Service Provider can connect each managed account with its own API credentials:

1. Use the Service Provider account's **Access ID**, **Password**, and **API Key**.
2. Enter the **managed account's ID** as the account ID, not the Service Provider's.
3. Create one Wirespeed integration per managed account.

Wirespeed requests a token scoped to the managed account through the WatchGuard Cloud Authorization API. Setup fails if the Service Provider does not manage that account.

## Add the integration in Wirespeed

1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **WatchGuard EDR**.
2. Enter the **Region**: `usa`, `deu`, or `jpn`.
3. Enter the **Access ID**, **Password**, and **API Key**.
4. Enter the **Account ID**.
5. Submit the integration.

On connect, Wirespeed requests an access token, then reads the account's licenses, one device, and the malware security events. Setup fails if any of these requests is rejected.

## Response actions

Wirespeed can isolate and unisolate WatchGuard-managed devices. Isolated devices display a message saying that your security team isolated the device from the network.

## Current limitations

* Detection categorization remains non-escalating until WatchGuard EDR WDC rules are defined.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.