WatchGuard Managed Detection & Response (MDR) is an outsourced security service that combines continuous monitoring, automated detection, and human-led investigation and response. The service monitors endpoint, network, identity, cloud application, and cloud infrastructure telemetry according to the selected service package.

WatchGuard MDR is designed to supplement internal security teams or provide managed security providers (MSPs) with an externally operated security operations center (SOC). Rather than forwarding every detection to the customer, SOC analysts validate alerts, investigate confirmed threats, and perform containment actions.

Key Capabilities

Continuous Security Monitoring: WatchGuard’s SOC monitors participating systems for suspicious activity and potential security incidents at all times.
Threat Validation: Automated analysis and human review filter duplicate, benign, and low-confidence events before incidents are escalated.
Managed Incident Response: Analysts investigate confirmed threats and perform containment actions instead of requiring the customer or MSP to respond independently.
Proactive Threat Hunting: Security analysts search available telemetry for suspicious behavior that may not have triggered an existing detection rule.
Root-Cause Analysis: Incident investigations trace affected systems, entry points, and related activity to determine how a threat developed and what resources were involved.
Endpoint, Network, Identity, and Cloud Correlation: Depending on the selected package, the service correlates signals from endpoints, firewalls, network detection systems, identity services, productivity platforms, and cloud audit logs.
Automated Containment: Automated response controls can block or isolate confirmed threats while analysts continue the investigation.
Incident Visibility and Reporting: The managed services portal provides detection records, investigation details, incident timelines, response activity, and reports intended to support security reviews, compliance processes, and cyber-insurance documentation.
Technical Account Management: MSP partners receive access to a technical account manager (TAM) who interprets SOC activity, conducts security reviews, and assists with service reporting.

Service Packages

Core MDR: Provides managed monitoring and response centered on WatchGuard endpoint security, with additional support for Microsoft 365 and compatible WatchGuard network telemetry.
Core MDR for Microsoft: Uses Microsoft Defender as the primary endpoint integration and includes Microsoft 365 monitoring.
Total MDR: Extends coverage across the WatchGuard security stack, including endpoint, network, identity, Microsoft 365, Google Workspace, and supported cloud telemetry.
Open MDR: Supports mixed security environments that use WatchGuard products alongside compatible third-party endpoint, identity, and firewall technologies.

Audience & Use Cases

Audience: WatchGuard MDR is intended for MSPs, small and midsize organizations, security administrators, and IT teams that require continuous monitoring and incident response without staffing an internal SOC for every monitored environment.
Use Cases: The service supports alert validation, threat hunting, incident investigation, endpoint isolation, threat containment, root-cause analysis, cross-domain detection, and security reporting.

Technical Specifications

Service Model: Fully managed detection and response
Monitoring Model: Continuous SOC monitoring
Response Methods: Human-led and automated incident response
Coverage Domains: Endpoint, network, identity, cloud applications, and cloud infrastructure, subject to package and integration availability
Management Interface: WatchGuard managed services portal
WatchGuard Integrations: WatchGuard Endpoint Security, Firebox, ThreatSync NDR, and AuthPoint
Supported Third-Party Technologies: Microsoft Defender, CrowdStrike, Okta, Duo, and compatible third-party firewalls
Cloud and Productivity Coverage: Microsoft 365, Google Workspace, and AWS CloudTrail for applicable packages
Operational Outputs: Detections, investigation records, incident timelines, containment details, and service reports

WatchGuard Managed Detection & Response

What is WatchGuard Managed Detection & Response?

Categories & Use Cases