WatchGuard ThreatSync+ NDR
Unified Network Security Made Simple

Features:

Lower Costs with Cloud-Native Architecture

100% open Cloud-native architecture removes the need for new hardware. ThreatSync+ NDR operates in the WatchGuard Cloud and works with your existing WatchGuard Firebox or third-party firewall as well as routers and switches, delivering rapid time to value and reducing the cost and complexity of managing hardware.

Detect Threats with Cutting-Edge AI

Running a multi-tier neural network, operating flow-based unsupervised and semi-supervised machine learning, ThreatSync+ NDR ingests NetFlow and quickly detects attacks that have bypassed perimeter defenses and are actively expanding in the network. The AI engine identifies C&C, lateral movement, unusual access, unusual data movement, beaconing, scanning, and other traffic-based attack processes.

Surface Hidden Network Risks

ThreatSync+ NDR continuously monitors your entire network for changes and applies intelligent risk scoring to focus your efforts on what is essential. From identifying all the devices operating on your network to alerting with rogue devices, new IoT devices or known vulnerabilities are discovered, ThreatSync+ NDR allows you to take back control of your network.

Execute Rapid Detection and Response

ThreatSync+ NDR reduces detection times to minutes and identifies attacks early enough to take action to prevent their damage. This includes identifying ransomware attacks early enough to block encryption and prevent internal network penetration from reaching partner networks. Working with ThreatSync remediation workflows, IT teams will reduce dwell times from weeks to hours.

Designed For Small Teams

Unlike traditional NDR solutions designed for a manpower-heavy SOC, ThreatSync+ NDR automation, intelligence, and operations are specifically designed for the operations of your existing team. No new headcount is required, training is simple and fast, and the product is intuitive and easy to operate. ThreatSync+ NDR delivers enterprise-class SOC capabilities without a high workforce or operational cost.

Anatomy of a Threat Report:

How much visibility do you have into what is happening on your network? Which devices are communicating with each other, and what types of data are being transmitted to and from your network? Understanding your network’s activities and identifying its risks and threats are crucial for protecting your entire organization and your suppliers, partners, and customers.

By proactively assessing your network’s security status with automated risk and threat reports, you can identify vulnerabilities or cyberattacks that may have evaded your perimeter defenses. This proactive approach empowers you to address these issues before damage occurs, strengthening your cybersecurity strategy and safeguarding your organization.

Core Network and Ransomware Reporting

ThreatSync+ NDR includes a Network Threat Report and Ransomware Defense Report. Both reports start with a summary section that displays the entire network’s overall risk score and trend. They then provide detailed information on various policies and controls actively monitored by the NDR system. Each sub-section shows the individual threat score and trend line for each policy or control being monitored, and if any gaps or failures are found, guidance on how to remediate them. These reports are easily customizable to meet the specific needs of organizations or cyber defense programs. Their purpose is to highlight existing issues and provide managers with a way to establish network defense goals and track progress and improvements toward them.

Network Threat and Ransomware defense reports provide highly detailed assessments of what is happening inside your network. They are essential to your cyber defense program because they provide the information needed to understand your security posture and what steps to take to improve it. The specific information included will vary depending on the assessment findings but typically include:

• A list of all the security risks that were identified.
• The criticality level of each risk, typically classified as critical, high, or medium.
• A description of each risk, including the type, severity, and potential impact.
• Recommendations for removing each risk, such as installing security updates, removing malware, isolating devices, changing credentials, or configuring security settings.

Examples of specific security risks that may be identified in the assessment:

ThreatSync Purchase Options:

ThreatSync Core offers a base set of XDR capabilities with qualifying network and endpoint security product purchases at no additional charge. Additional ThreatSync+ product licenses can be purchased separately to add advanced XDR capabilities such as third-party product feeds and deep AI-based detections, monitoring, and analysis.

WatchGuard’s family of XDR products enables MSPs and companies of every size to deploy a foundational core of XDR functionality and add advanced options to quickly expand protection across threat surfaces and attack vectors. Choose the ThreatSync products that best suit your environment to deploy a custom solution that fits your needs and capabilities.

• ThreatSync Core includes foundational XDR capabilities:
  • Threat information correlation
  • Incident scoring and management
  • Intelligent automated remediation
  Features are platform-ready and available for each network and endpoint security product activation at no additional charge.
• ThreatSync+ XDR products can be purchased separately to add advanced XDR capabilities, including third-party product feeds and AI-based detections, monitoring, and analysis.
• ThreatSync+ NDR: 100% Cloud-native, AI-powered threat detection and response solution that requires no hardware and protects on-premises network, VPN, and identity threat surfaces.
• ThreatSync+ SaaS: 100% Cloud-native, AI-powered threat detection and response solution that requires no hardware and protects SaaS applications, Cloud platforms, and Cloud identity threat surfaces.
• WatchGuard Compliance Reporting enhances ThreatSync and WatchGuard Cloud reports, providing comprehensive compliance reporting for business and regulatory needs.
• ThreatSync Suite: Single integrated package including ThreatSync Core, ThreatSync+ products (NDR, SaaS, and future identity/EDR integration), and WatchGuard Compliance Reporting, offering a complete integrated XDR solution.

Specifications:

Documentation:

Download the WatchGuard ThreatSync+ NDR (.PDF)