WatchGuard API

The common use is a WatchGuard Cloud alert that a Firebox’s cloud connection went offline or came back online: the agent checks the Firebox and writes whether it is back and since when it was down.

Automatically enabled when you configure WatchGuard permissions in your agent workflow.

What It Does

Pick the client’s WatchGuard Cloud account by name from the accounts you manage
Read a Firebox’s or access point’s state, offline since, uptime, public IP, model, serial and firmware
Read the Firebox Executive and Security dashboard reports
Read BOVPN tunnels, firewall policies, networks, SD-WAN, users and schedules of a cloud-managed Firebox
Read, add and remove Firebox and FireCloud exceptions: blocked sites, WebBlocker, botnet, file, IPS, geolocation and HTTPS
Deploy saved exceptions or configuration to named Fireboxes, and read the deployment’s result
Find a computer in WatchGuard Endpoint Security (EPDR, EDR, EPP, Panda Aether) and read its protection, security events, risks and missing patches
Isolate a computer, stop the isolation, reboot it or scan it
Read ThreatSync incidents and act on them: isolate, end a process, quarantine a file, block an address, set the status, add comments
Read accounts, licences, allocations and contracts
Send an AuthPoint test push and read its result

For AuthPoint, Neo reaches only the Authentication API: a token unlock, resync or reassignment, or a user change, stays in the AuthPoint console. Locally managed Fireboxes show their status, reports and exceptions; their policies and VPN stay on the device.

How the agent handles a Firebox offline alert

The agent finds the account for the ticket’s company and lists its devices. It matches the Firebox name or serial number in the alert to a device and reads its state. When the Firebox is online and its uptime started after the alert, it writes when the Firebox came back. When it is still offline, it writes since when and the last public IP. What happens to the ticket next follows your instructions.

Permission Groups

Group	Access levels	Covers
Firebox Devices and Reports	Disabled, Read Only	Fireboxes, FireClusters and access points: status, offline since, uptime; the dashboard reports
Firebox Exceptions	Disabled, Read Only, Read / Write	Firebox and FireCloud exceptions
Firebox Configuration	Disabled, Read Only, Read / Write	Firewall policies, BOVPN tunnels, certificates, networks, users, templates, deployments
Endpoint Security	Disabled, Read Only, Read / Write	Devices, protection, security events, risks, patches, tasks; isolate, reboot, scan
ThreatSync and NDR	Disabled, Read Only, Read / Write	ThreatSync incidents, actions and comments; NDR assets and Smart Alerts
Accounts and Licensing	Disabled, Read Only, Read / Write	Accounts and managed accounts, operators, activations, allocations, contracts, invoices
AuthPoint Authentication	Disabled, Read Only, Read / Write	Push and its status, OTP and QR code checks, the authentication policy for a user

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read	Every write
IT Admin	Isolating, scanning and rebooting endpoints, ThreatSync containment and incident updates, AuthPoint push	Exceptions, Firebox configuration and account changes, and every write under Safety Controls
Full Automation	Every write except those below	Only the writes below

Safety Controls

Control	Behavior
Exceptions	A Firebox exception follows the access profile, and reaches the Firebox only through a deployment, which always asks. A FireCloud exception that lets traffic through or skips a scan always asks a technician, and so does removing a FireCloud blocked-site entry
Firebox configuration	Firewall policy, BOVPN, certificate and template changes, and disabling global exceptions, always ask a technician
Deployments	Every deployment always asks a technician, and it must name its Fireboxes
Endpoints	Every endpoint action must name its devices. Uninstalling protection and moving devices to another security configuration always ask a technician
ThreatSync	Undoing an isolation or a block always asks a technician
Accounts	Operator changes, deallocations, purchase orders and contract suspend or cancel always ask a technician
Right account	A call to a client’s devices, configuration, endpoints or incidents names that client’s account id; a call for an account your credential does not manage is refused. Operator calls name the client’s account in the body or the query; order and activation calls name no account and run in your own WatchGuard Cloud account
Refused	Neo does not delete a WatchGuard Cloud account, create a partner account, read Azure access credentials, check a user’s password, or send a ThreatSync batch

How to Configure

Connect WatchGuard

Save your WatchGuard Cloud API credential in the Neo Dashboard under the Networking integrations category. See Connecting WatchGuard to Neo.

Configure permissions

In your agent workflow’s Integrations tab, choose an access profile or set each permission group by hand.

Start with Read Only. Checking a Firebox after an offline alert needs only reads in WatchGuard; the note on the ticket is written with the PSA tools.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

How the agent handles a Firebox offline alert

Permission Groups

Access Profiles

Safety Controls

How to Configure

​What It Does

​How the agent handles a Firebox offline alert

​Permission Groups

​Access Profiles

​Safety Controls

​How to Configure

What It Does

How the agent handles a Firebox offline alert

Permission Groups

Access Profiles

Safety Controls

How to Configure