WatchGuard SIEMFeeder
Description
Description
The WatchGuard SIEMFeeder is a cloud-delivered service that sends enriched endpoint security telemetry from your WatchGuard Endpoint Security deployment straight into your existing SIEM platform. Before delivery, SIEMFeeder takes the data and enriches it with security intelligence, then creates a single data flow to a compatible SIEM server. This gives your security team far deeper visibility of the processes running across your workstations and servers, helping to detect unknown threats, targeted attacks and advanced malware.
SIEMFeeder acts as the link between the protection software on your company computers and your SIEM server. It does not make any changes to the settings of a monitored computer or network, and it operates within the Endpoint Security infrastructure. Logs are collected using the WatchGuard Event Importer application, which can save them to a local or remote folder, or forward them to a syslog or Apache Kafka server.
Choose the band that matches your number of users and the term, then set the quantity to your number of users.
Key Features
- Enriches endpoint process data with WatchGuard security intelligence before it reaches your SIEM
- Centralised endpoint management through WatchGuard Cloud
- Easy to install and configure
- Event filtering prior to integration into the SIEM tool, helping to reduce SIEM storage costs
- Configurable log format: LEEF or CEF (logs are sent in LEEF by default)
- Secure event download over TLS connections
- Flexible delivery via a shared folder, syslog server or Apache Kafka server
- Service retains undelivered logs for up to seven days (up to 80 GB per customer) to help prevent data loss during connectivity failures
Ideal for: IT security specialists, SOC teams, managed security service providers (MSSPs) and organisations of any size that already run a SIEM and want richer endpoint visibility from WatchGuard Endpoint Security.
Compatible Products
SIEMFeeder is available with WatchGuard EDR, Endpoint Security Prime, Endpoint Security 360 and Endpoint Security Elite. You need as many active SIEMFeeder licences as you have licences for these endpoint products.
Compatible SIEM Platforms
Any SIEM that supports CEF or LEEF is compatible. WatchGuard's documented supported servers include AlienVault Unified Security Management (USM), Fortinet FortiSIEM, HPE ArcSight, IBM QRadar, McAfee Enterprise Security Manager, LogRhythm, SolarWinds Log & Event Manager and Splunk.
FAQs
Which SIEM platforms does WatchGuard SIEMFeeder work with?
It works with any SIEM that can manage events in CEF or LEEF format and ingest them through a syslog server, a Kafka server or a shared folder. Documented examples include Splunk, IBM QRadar, HPE ArcSight, AlienVault USM and LogRhythm.
Which WatchGuard products does SIEMFeeder require?
Your computers must be protected by WatchGuard EDR, Endpoint Security Prime, Endpoint Security 360 or Endpoint Security Elite, with matching SIEMFeeder licences.
How do I receive the logs?
You install WatchGuard Event Importer on a computer in your network. It downloads the log files from the Microsoft Azure infrastructure and saves them to a folder or sends them to a syslog or Apache Kafka server.
Which log formats are supported?
Logs are sent in LEEF format by default. CEF format is available on request to WatchGuard.
What are the Event Importer hardware requirements?
A 1 GHz or faster processor and a minimum of 512 MB RAM, plus free disk space for the log data. On average, Event Importer uses 1 MB of storage per computer, per hour.
Payment & Security
Payment methods
Your payment information is processed securely. We do not store credit card details nor have access to your credit card information.
-
WatchGuard
Real Security for the Real World
WatchGuard is an American cybersecurity company that provides best-in-class security solutions for MSPs and IT professionals across the globe. In physical, virtual and Cloud environments, networks are being inundated with cyberattacks, which can make securing business assets an overwhelming challenge. As a pioneer in the unified cybersecurity field, WatchGuard has decades of experience developing simple, accessible and easy-to-use products designed to safeguard business-critical assets against evolving malware, network, and endpoint security threats. The company is always working to stay ahead of bad actors operating across the threat landscape. Leveraging emerging technologies including AI and machine learning, WatchGuard arms you with the most powerful and effective tools to protect your business.
Powered by its award-winning, flagship Unified Security Platform, WatchGuard’s comprehensive product portfolio spans network and endpoint security, secure wireless, multi-factor authentication, and network intelligence. WatchGuard’s enterprise-grade Firebox firewalls offer ironclad protection against even the most sophisticated, malicious threats. Widely deployable, Fireboxes are delivered as physical appliances or as virtual/cloud solutions, all at an affordable price point. WatchGuard’s extensive endpoint security solutions offer advanced protection for end users and devices, including endpoint antivirus, security operations, and DNS-level protection and content filtering.
With WatchGuard, you don’t just buy a standalone security device, you receive a holistic security management solution that provides peace of mind. Regular updates on feature enhancements and emerging security threats ensure you get the most out of your WatchGuard security solutions. For smart security, simply done, choose WatchGuard.
-
Why buy from The Tech Geeks?
As a longtime WatchGuard partner, we have seen WatchGuard solutions deliver a vast array of benefits for our customers. WatchGuard is a continuous innovator in the cybersecurity world, designing their products to evolve with increasingly sophisticated cybercrime activity.
If you require advice on any WatchGuard product, please reach out to one of our friendly team members. Choosing the correct firewall, wireless or endpoint security solution for your network is less about physical size and more about security capabilities and operational fit. The right security implementation will depend on many factors: use case, office size, number of devices, hardware or software preferences, remote connectivity and encryption requirements – all of which can be overly technical.
Our capable team knows network security, firewalls, endpoint security and wireless configuration inside out. We can provide you with unbiased, to-the-minute advice tailored for your IT implementation. Your time is precious, so don’t waste it - contact us today at The Tech Geeks for real-time support and best-price quoting.
