Applies To: ThreatSync
The Monitor menu in the ThreatSync management UI is where you monitor and perform actions on incidents for your account.
Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the ThreatSync permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.
Summary Page
The Summary page opens by default in the Monitor > Threats menu for both Service Providers and Subscribers.
This page includes graphs, counters, and incident data and provides a snapshot of incident activity for your account over a specified period of time. For more information, go to ThreatSync Incident Summary.
Incidents Page
The Incidents page provides a centralized list of incidents for Incident Responders to review. For more information about how to filter the incidents on this page, go to Monitor ThreatSync Incidents.
From the Incidents page, you can monitor the incidents that occur in your environment, and complete these tasks:
- Review Incident Details
- Close or Change the Status of Incidents
- Perform Actions on Incidents and Endpoints
Endpoints Page
The Endpoints page shows a list of endpoints and incidents that occur on them for Incident Responders to review. For more information about how to use this page, go to Monitor ThreatSync Endpoints.
From the Endpoints page, you can:
- Review Endpoint Details
- Change the Date Range
- Sort and Filter the Incident List
- Isolate or Stop Isolation of an Endpoint
- Remote Control