WatchGuard MDR: Core, Total and Open MDR

What WatchGuard MDR is

WatchGuard MDR is a managed service. WatchGuard describes it as providing security monitoring, threat hunting, attack detection, investigation and containment, with WatchGuard's cybersecurity experts using AI technologies to monitor your environment 24/7.

In practice that means:

• Continuous monitoring and threat hunting: the WatchGuard MDR team watches telemetry from your environment to find and investigate indicators of compromise and abnormal activity
• Investigation and guided response: when it finds a potential threat, the team investigates and gives remediation guidance, and depending on your configuration can isolate affected endpoints
• Coverage across your security stack: depending on licence, endpoints, WatchGuard products, cloud environments and selected third-party integrations
• One managed services portal, which WatchGuard describes as giving real-time insights, incident timelines and proof-of-protection reports for compliance and cyber insurance

It is aimed at organisations without their own 24/7 security team: instead of an EDR alert waiting until someone reads it in the morning, an analyst looks at it when it fires. WatchGuard runs the security operations centre; we help you choose the right service, set it up and act on what it finds.

The four WatchGuard MDR services compared

WatchGuard offers four main MDR services. All include 24/7 SOC monitoring, threat hunting and incident response; the difference is what they watch:

Fireboxes monitored by Total or Open MDR need the Total Security Suite or Prime Security Suite. Endpoint Security Basic is not MDR-compatible, so Basic users move up to Prime or above first; see WatchGuard EPDR for the editions.

Core MDR

Core MDR is the simplest option: WatchGuard's team watches endpoints protected by WatchGuard Endpoint Security Prime, 360 or Elite. It is licensed as an Endpoint Security module, with one licence for each endpoint covered by your edition licence, so it is easy to add to an existing WatchGuard estate. Microsoft 365 monitoring is available as an option, which helps catch account compromise that starts in email rather than on a laptop.

Choose Core MDR if you already run, or plan to run, WatchGuard Endpoint Security and your main concern is devices.

Core MDR for Microsoft

Many organisations already pay for Microsoft Defender for Endpoint, for example through Microsoft 365 Business Premium or E5, but have nobody watching its alerts. Core MDR for Microsoft puts WatchGuard's team on top of Defender: each monitored endpoint needs its own Defender for Endpoint P1 or P2 licence, which you bring yourself.

If you are standardised on Microsoft, this lets you add managed detection and response without replacing the endpoint protection you already pay for. Forever Group can supply the Microsoft licences separately. For more on Defender itself, see Microsoft Defender for Endpoint on our Cloud Security site.

Total MDR

Total MDR is full-stack MDR for organisations that use WatchGuard beyond the endpoint. Alongside WatchGuard Endpoint Security, it can watch Fireboxes, WatchGuard NDR, AuthPoint MFA, FireCloud and cloud environments including Microsoft 365 and Microsoft Azure posture.

The value is correlation: a suspicious sign-in on AuthPoint, unusual traffic through a Firebox and a process on a laptop can be investigated as one incident rather than three. That is the same idea as extended detection and response, delivered as a service. Identity coverage needs an AuthPoint licence for the users concerned.

Open MDR

Open MDR is for mixed estates. It works with WatchGuard Endpoint Security, CrowdStrike Falcon Insight or Microsoft Defender for Endpoint as the endpoint source, and can monitor WatchGuard and supported third-party firewalls, identity providers, cloud services and NDR.

That makes it useful if you have already invested in another vendor's EDR, such as CrowdStrike Falcon Insight XDR, and want a managed service without replacing it. You keep your own licences for the third-party tools. Supported integrations change over time, so we confirm support for your exact tools at quote.

Vulnerability Management and Managed Zero Trust

WatchGuard lists two related offerings alongside the four MDR services:

• WatchGuard Vulnerability Management, which WatchGuard describes as centralised vulnerability scanning without dedicated infrastructure, available as part of its MDR solution
• WatchGuard Managed Zero Trust, a bundle that brings identity, device security, secure access and zero trust enforcement together in one cloud-managed service, which WatchGuard says can be paired with its MDR

Licence rules differ between these and the core services, so we check what your mix needs before we quote. For the principles behind the second, see zero trust endpoint security.

Onboarding WatchGuard MDR

Every WatchGuard MDR service runs through WatchGuard Cloud, so onboarding is mostly configuration rather than new hardware:

1. Endpoints: deploy or confirm the WatchGuard agent on Prime, 360 or Elite, or connect Microsoft Defender for Endpoint or CrowdStrike for Core MDR for Microsoft and Open MDR.
2. Other sources: connect Microsoft 365 and, for Total and Open MDR, the firewalls, identity providers and cloud services you want covered.
3. Permissions: agree whether WatchGuard's team may isolate a computer without asking first, and who it should contact during an incident.
4. Reporting: set a reporting schedule and decide who reviews incidents in the Managed Services portal.

We can do the configuration with you and help you act on WatchGuard's remediation guidance after go-live.

Which WatchGuard MDR service to choose

A quick guide:

Core MDR is licensed per endpoint; Core MDR for Microsoft, Total MDR and Open MDR are licensed per user, with each user covering one endpoint device. Licensing detail is on our WatchGuard MDR licensing page.

MDR does not replace good basics. Patching, MFA and staff awareness still reduce how often the security operations centre has to act. Compare WatchGuard's service with others on our endpoint security vendors page, or read about managed detection and response in general.

Contact us to talk about WatchGuard MDR. We can help you pick the service, license the prerequisites, onboard your sources and agree response permissions with WatchGuard's team.