ThreatSync requires a new version of WatchGuard Endpoint Security by 31 August 2023

We’re excited to unveil a groundbreaking addition to ThreatSync—the ability to correlate identity-related incidents, powered by AuthPoint’s Multi-Factor Authentication (MFA) alerts and activities.

Enhancing Threat Detection with Identity Insights

ThreatSync now features advanced capabilities to detect Credential Access incidents by integrating critical Identity Indicators of Compromise (IoCs) and Indicators of Attack (IoAs). By leveraging data from AuthPoint’s MFA events, alerts, and remediation activities, this new feature fortifies your organization’s defenses against common attack vectors targeting identities, such as:

• Login Attempts with Incorrect Passwords: Identify repeated failed login attempts that may signal credential stuffing or brute-force attacks.
• Excessive Push Notifications: Detect situations where users are overwhelmed with push notifications, a potential sign of MFA fatigue attacks.
• Policy-Based Authentication Denials: Monitor and act on authentications denied due to security policies, highlighting policy enforcement.
• Blocked Tokens Due to Failed Attempts: Recognize when tokens are blocked following multiple failed authentication attempts, indicating potential misuse.
• Disabled Push Notifications by Users: Address cases where users disable push notifications, potentially compromising MFA effectiveness.
• Unknown User Authentication Attempts: Identify and investigate authentication attempts by unrecognized users, signaling potential unauthorized access attempts.

Key Benefits of the New ThreatSync Feature

• Seamless Identity Threat Detection: Automatically correlate identity-related incidents for faster, more accurate threat detection.
• Integrated Security: Utilize ThreatSync’s detection and remediation tools alongside WatchGuard’s comprehensive suite of security solutions.
• Simplified Security Management: Streamline incident response processes with a unified approach to security.

With this new capability, ThreatSync users can harness its robust detection and remediation tools alongside WatchGuard’s full suite of integrated security solutions, boosting incident response and simplifying security management.

The WatchGuard Team

We are excited to announce a new beta feature for ThreatSync!

AuthPoint Incidents in ThreatSync

This feature enables you to view and manage AuthPoint incidents in ThreatSync. AuthPoint sends incident data to ThreatSync in the form of Credential Access events. These Credential Access incidents are available:

• Login attempts with incorrect password
• User received too many push notifications
• Authentication denied by AuthPoint policy
• Token blocked by too many failed authentications
• User disabled push notifications
• Authentication attempt from an unknown user

Based on the type of Credential Access incident, you can use these remediation actions:

• Block user
• Block IP address
• Isolate device

To learn more or to report an issue, go to the ThreatSync Beta test community.

Before you submit your feedback, make sure to review the list of Known Issues.

We appreciate you testing these exciting new features. Thanks for your help in making our products better!  

The WatchGuard Beta Team

We are excited to announce a new beta for ThreatSync!

     Monitored Accounts for Service Providers (Beta)

This feature enables Service Providers to select which of their managed accounts they want to view data for in their ThreatSync Service Provider pages. 

To learn more or to report an issue, go to the ThreatSync Beta test community.

Before you submit your feedback, make sure to review the list of Known Issues.

We appreciate you testing these exciting new features. Thanks for your help in making our products better!  

The WatchGuard Beta Team