In short: WatchGuard NDR, formerly ThreatSync+ NDR, analyses network telemetry with machine learning to spot attacks such as lateral movement and data exfiltration. NDR for Firebox covers traffic through a Firebox and is licensed per Firebox; WatchGuard NDR adds switches, other firewalls and cloud flow logs per user; Total NDR adds SaaS DR and compliance reports.
What WatchGuard NDR is
Network detection and response (NDR) watches how devices on your network behave and flags activity that looks like an attack, such as a workstation scanning its neighbours, a device tunnelling data over DNS or a server sending unusual volumes of data out. It catches things endpoint protection cannot see, including unmanaged devices, IoT equipment and attackers using legitimate tools.
WatchGuard NDR was previously called ThreatSync+ NDR, and its SaaS companion ThreatSync+ SaaS is now WatchGuard SaaS DR. The technology came from CyGlass, which WatchGuard acquired, and it runs in WatchGuard Cloud rather than on dedicated sensors. Detections feed ThreatSync, so response actions such as blocking an address on a Firebox, isolating a device with Endpoint Security 360 or disabling a user in Active Directory or AuthPoint can be taken from the same place.
The three NDR options
| NDR for Firebox | WatchGuard NDR | Total NDR | |
|---|---|---|---|
| Network activity through a Firebox, including VPN and DHCP | Yes | Yes | Yes |
| NetFlow or flow logs from any switch, router or firewall | No | Yes | Yes |
| DHCP logs from Active Directory | No | Yes | Yes |
| Cloud workload flow logs (Azure, AWS) | No | Yes | Yes |
| Microsoft 365 application logs, through SaaS DR | No | No | Yes |
| Executive summary and ransomware prevention reports | Yes | Yes | Yes |
| Defence goal reports | No | Yes | Yes |
| Compliance reports | No | No | Yes |
Total NDR is the bundle of WatchGuard NDR, WatchGuard SaaS DR and WatchGuard Compliance Reporting. For 24/7 monitoring of these detections by WatchGuard's SOC, WatchGuard Total MDR can include NDR among its sources.
How it is licensed
- NDR for Firebox is licensed per Firebox, priced by model, and each Firebox you want monitored needs its own licence. In an active/passive pair only the active Firebox needs one.
- WatchGuard NDR is licensed per user, and each user allocation covers up to two active network devices, such as a laptop and a phone.
- Total NDR is licensed per user and includes SaaS DR and Compliance Reporting, which are otherwise separate licences.
Licences are activated in your WatchGuard account and allocated in WatchGuard Cloud. Ask us for a quote and tell us which firewalls, switches and cloud services you want covered.
Requirements and deployment
Cloud-managed Fireboxes, and locally managed ones with cloud reporting, on a supported Fireware version send traffic data to WatchGuard NDR automatically. For third-party firewalls, switches and older Fireboxes, you install a collection agent on a Windows or Ubuntu Linux computer on your network. It receives NetFlow, sFlow and DHCP log data and forwards it securely to WatchGuard Cloud, and a separate Windows Log Agent on your DHCP servers keeps track of devices as their addresses change. There is no in-line sensor and no change to your network design.
Because NDR judges activity against what is normal for your network, expect a tuning period after deployment while it learns your traffic and you confirm which alerts matter.
Who it suits
NDR for Firebox suits organisations whose traffic mostly passes through Fireboxes and who want behavioural detection on top of the security suite. WatchGuard NDR suits networks with many unmanaged or IoT devices, or third-party switches and firewalls. Total NDR suits those who also want Microsoft 365 activity and scheduled compliance reports in one licence.
How we help
We check that your firewalls and switches are supported, deploy collection agents where needed, connect your Fireboxes and SaaS services, and review early detections with you so alerts are tuned to your network. Compare approaches in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is ThreatSync+ NDR the same as WatchGuard NDR?
Yes. ThreatSync+ NDR is now called WatchGuard NDR, and ThreatSync+ SaaS is now WatchGuard SaaS DR. The service carries on under the new names in WatchGuard Cloud.
What does Total NDR include?
Total NDR includes WatchGuard NDR, WatchGuard SaaS DR and WatchGuard Compliance Reporting in one per-user licence, adding Microsoft 365 application logs and compliance reports to network detection.
Do I need a WatchGuard Firebox for NDR?
Not for WatchGuard NDR or Total NDR, which can take data from third-party firewalls and switches through a collection agent. NDR for Firebox, as the name suggests, needs a Firebox.
How is WatchGuard NDR licensed?
WatchGuard NDR and Total NDR are licensed per user, with each user covering up to two active network devices. NDR for Firebox is licensed per Firebox, by model.