Alerts

• WatchGuard XTM: Device configuration changed - This alert is triggered when a device configuration is changed by a user.
• WatchGuard XTM: Attack detected - This alert is triggered when an attack is detected by the WatchGuard XTM firewall.

Reports

• WatchGuard XTM - Device configuration change details - This report provides information related to a device configuration change when a user performs any changes in WatchGuard XTM.
• This report captures the changed item information in the message details column and shows the time and the firewall device configuration on which the changes were made.
• WatchGuard XTM - Attack detected - This report provides information related to attack detected by WatchGuard XTM. It contains the Columns Log Time, Computer or Device name, Attack Type, Source Address and Target Address. It briefs an administrator about attacks detected from suspicious hosts with target IP and attack details.
• WatchGuard XTM – IPS traffic detected – This report provides information related to intrusion prevention traffic detected. It contains the source IP Address, Source port, Destination IP Address, Destination Port, policy name, signature name, signature category, signature id, and status.

Alerts

• WatchGuard XTM: User authentication failed - This alert is triggered when a user tries to authenticate, and then fails. (e.g. When a user tries to login using SSL/VPN, or similar services).
• WatchGuard XTM: User login failed – This alert is triggered when a user tries to login but fails. For e.g. Incorrect username or Password. (e.g. user tries to login from GUI).

Reports

• WatchGuard XTM - Proxy details - This report provides information related to traffic allowed or denied by proxy policy, which includes Host Address, Source Address, Source port, Destination Address, Destination Port, Action, Message and Policy Name fields. It briefs an administrator about proxy traffic passing through the firewall with actions taken consistent with the applied policy.
• WatchGuard XTM – IP spoofing and blocked site traffic detected – This report provides information related to IP spoofing and blocked site traffic detected. It contains the source IP address, targets IP address, and traffic type.

Alerts

• WatchGuard XTM: Customized certificate generation error - This alert is triggered when customized certificate generation error occurs.
• WatchGuard XTM: System shutdown or restart – This alert is triggered when a system is shut down or restarted.

Reports

• WatchGuard XTM - User authentication failed - This report provides information related to user authentication failed event. when user authentication fails. It explains failed authentication. (e.g. When a user tries to login using SSL/VPN, or similar services)
• WatchGuard XTM – User authentication success – This report provides information related to user authentication success events. When a user tries to authenticate and succeeds.
• WatchGuard XTM - User login failed - This report provides information related to user logon failed event. When a user tries to login and it fails. It has the column Log Time, Computer or Device name, Username, User Type and Source Address and Assigned Virtual Client IP Address.
• WatchGuard XTM - Traffic details - This report provides information related to inbound and outbound traffic. The report includes- Log Time, Computer or Device name, Status, In Interface Name, Out Interface Name, Source IP Address, Source Port, Destination IP Address, Destination Port, Application Behavior Name, Application Category ID, Application ID, Application Name, Category Name, Message, Policy Name. It briefs an administrator about traffic passing through the firewall with actions taken consistent with the applied policy.