Applies To: WatchGuard XTM Fireware v11.10.2-v11.10.5

Overview

XTM Series appliances combine firewall/VPN with powerful security services and a suite of flexible management tools. EventTracker continually collects firewall events and leverages machine learning to identify possible attacks, suspicious network traffic and user behavior analytics.

EventTracker supports WatchGuard XTM firewall monitoring and generate alerts, reports for critical events.EventTracker assists in evaluation of user behavior trends and statistical visualization of relevant results.

WatchGuard XTM Firewall Logging

EventTracker Knowledge Pack for WatchGuard XTM firewall allows you to monitor the following:-

• Operations:- High availability activity, Link monitoring, DHCP relay activity, User activity and Content filtering.
• Security:- Anti-Spam service and WLAN IDS activity.
• Compliance:- Logon and authentication activity, Network access activity, Firewall alerts , VPN tunnel and client activity.

Previous Next

Once WatchGuard XTM Firewall is configured to deliver events to EventTracker Manager; alerts, dashboards and reports can be configured into EventTracker.

Some of the Knowledge Packs available in EventTracker are listed below. For more information please refer Integration Guide.

Scope

The configurations detailed in this guide are consistent with EventTracker Enterprise version 7.X and later, WatchGuard XTM Fireware v11.10.2-v11.10.5.

Documentation:

To configure WatchGuard to send logs to EventTracker, refer the How to Guide.

For more information please refer the Integration guide