In short: WatchGuard MDR is a 24/7 managed detection and response service run by WatchGuard's security operations centre. Core MDR watches WatchGuard-protected endpoints; Core MDR for Microsoft watches Microsoft Defender for Endpoint; Total MDR adds Fireboxes, NDR, AuthPoint, FireCloud and cloud services; Open MDR covers third-party tools such as CrowdStrike, Okta and Duo.
What WatchGuard MDR is
WatchGuard MDR is a managed service: WatchGuard's security operations centre (SOC) monitors telemetry from your security tools around the clock, investigates suspicious activity, hunts for threats that have not triggered an alert and contains confirmed attacks, for example by isolating a device. Every package includes threat hunting, incident response with root cause analysis, post-breach investigation and reporting through WatchGuard's portal.
It is aimed at organisations without their own 24/7 security team. Instead of an EDR alert waiting until someone reads it in the morning, an analyst investigates it when it fires.
The four MDR services compared
| Service | What it monitors | Requires |
|---|---|---|
| Core MDR | Endpoints protected by WatchGuard Endpoint Security, with optional Microsoft 365 monitoring | Endpoint Security Prime, 360 or Elite |
| Core MDR for Microsoft | Endpoints protected by Microsoft Defender for Endpoint, with optional Microsoft 365 monitoring | Your own Defender for Endpoint P1 or P2 licence on each endpoint |
| Total MDR | WatchGuard endpoints plus Fireboxes, NDR, AuthPoint, FireCloud, Microsoft 365, Google Workspace, AWS CloudTrail and Azure and AWS cloud posture | Endpoint Security Prime, 360 or Elite; Total or Prime Security Suite on monitored Fireboxes; an AuthPoint licence for identity coverage |
| Open MDR | WatchGuard Endpoint, CrowdStrike Falcon Insight or Microsoft Defender, plus WatchGuard and many third-party firewalls, AuthPoint, Duo, Okta, FireCloud and cloud services | Licences for the third-party tools you connect |
WatchGuard also offers a Managed Zero Trust package built around its Zero Trust Bundle, and WatchGuard Vulnerability Management, which adds centralised vulnerability scanning as part of its MDR offering.
How WatchGuard MDR is licensed
Core MDR is licensed as an Endpoint Security module, with one licence for each endpoint covered by your Prime, 360 or Elite licence. Core MDR for Microsoft, Total MDR and Open MDR are licensed per user, and each licensed user covers one endpoint device.
Core MDR for Microsoft relies on Microsoft Defender for Endpoint, which you license separately; Forever Group's Microsoft licensing team can supply it. Open MDR with CrowdStrike likewise needs your own Falcon Insight licence. Ask us for a quote for the service and coverage you need.
Requirements and onboarding
All four services are run through WatchGuard Cloud. Onboarding usually means deploying or confirming the endpoint agent, connecting Microsoft 365 and any other cloud sources, agreeing who the SOC contacts and what it may do on your behalf, such as isolating a computer without asking first, and setting a reporting schedule. For Total and Open MDR, the firewalls, identity providers and cloud services you want covered are connected as integrations.
Which service to choose
- Already on WatchGuard Endpoint Security and mainly concerned with devices: Core MDR.
- Standardised on Microsoft Defender for Endpoint, for example through Microsoft 365 Business Premium or E5: Core MDR for Microsoft.
- Using Fireboxes, AuthPoint or FireCloud and wanting the whole WatchGuard estate watched: Total MDR.
- Mixed estate with CrowdStrike, Okta, Duo or another vendor's firewalls: Open MDR.
MDR does not replace good basics. Patching, MFA such as AuthPoint and staff awareness still reduce how often the SOC has to act.
How we help
We help you pick the right package, make sure the prerequisites are licensed, onboard your sources, agree response permissions with you and the WatchGuard SOC, and review reports with you. See other providers in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between WatchGuard Core MDR and Total MDR?
Core MDR monitors endpoints protected by WatchGuard Endpoint Security, with optional Microsoft 365 coverage. Total MDR adds Fireboxes, NDR, AuthPoint, FireCloud and cloud sources such as Google Workspace, AWS and Azure.
Can WatchGuard MDR monitor Microsoft Defender?
Yes. Core MDR for Microsoft monitors endpoints running Microsoft Defender for Endpoint, and Open MDR can use Defender too. Each endpoint needs its own Defender for Endpoint P1 or P2 licence, which Forever Group can supply.
Does WatchGuard Open MDR work with CrowdStrike?
Yes. Open MDR supports CrowdStrike Falcon Insight as the endpoint source, alongside identity providers such as Okta and Duo and many third-party firewalls. You keep your own CrowdStrike licence.
Which endpoint editions work with Core MDR?
Core MDR works with Endpoint Security Prime, 360 and Elite, and with WatchGuard EDR. It is added as a module covering the same number of endpoints as the edition licence. Endpoint Security Basic is not MDR-compatible.