Enhancements to Our Botnet Detection Service
As part of our ongoing mission to enhance threat visibility and provide intelligent, proactive protection, WatchGuard is rolling out important updates to the Botnet Detection service on WatchGuard Firewalls.
These enhancements are designed to improve detection accuracy and expand the scope of threat intelligence, helping you identify more potentially malicious activity on your network. As a result, you may notice an increase in detection events, which is expected and reflects stronger visibility into emerging threats.
What’s Changing
-
Expanded Filtering of Threat Intelligence Feeds
We’ve updated how we filter threat data from our Proofpoint integration, following new guidance from their team. This change triples the number of suspicious IP addresses we monitor in the Botnet Detection service.What to expect: You may see more botnet-related detections. This does not mean your network is under greater attack, it simply means your WatchGuard device now has a broader view of potentially risky activity.
-
New Brute Force Threat Category
We’re introducing a new category that flags IPs associated with brute-force login attempts, where attackers try to guess passwords to gain unauthorized access.Why it matters: This update helps you detect and stop credential-guessing activity earlier. We also strongly recommend enabling Multifactor Authentication (MFA) wherever possible to protect against these attacks.
-
New Scanning Threat Category
The Scanning category flags IPs known for performing reconnaissance scans, a common precursor to targeted attacks.How to manage it: While we recommend blocking these types of scans. WatchGuard maintains an allowlist of these trusted sources, and you can also manage custom exceptions through your device or WatchGuard Cloud.
What It Means for You
Don’t be alarmed by an increase in detections. These changes are expected and reflect improved visibility, not necessarily an increase in malicious activity. It’s important to review your Botnet Detection configuration and settings to ensure they match your organization’s needs and risk profile.
TIP: WatchGuard Cloud users can activate ThreatSync to add context to Botnet detections.
If you have questions about these changes or need support reviewing your detection policies, our support team and WatchGuard Partners are here to help.
