WatchGuard Endpoint Security
Run WatchGuard Endpoint Security conversationally - devices, protection status, security events, risk, and gated device actions across your managed accounts.
Dex connects to WatchGuard Endpoint Security (Advanced EPDR / EPDR / EDR / EDR Core / EPP) through the WatchGuard Cloud Endpoint Security Management API so admins can run endpoint protection in plain language - list devices and protection status, spot unmanaged machines, review licenses and managed configurations, check security event counters and the security overview, and read the company risk summary and per-device risk. Gated device actions let Dex start an immediate scan, isolate or stop isolating devices, reboot, link devices to a managed configuration, and (when enabled) uninstall protection, each behind an it_admins approval. WatchGuard is an MSP global app: one shared WatchGuard Cloud Service Provider credential covers every managed Subscriber account, and each Dex tenant is confined to its own WatchGuard Cloud account via account_id. Admin-only - Dex Go is off, so there are no employee self-service workflows.
What Dex does with WatchGuard Endpoint Security
Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.
For admins (Dex Pro)
- List managed WatchGuard Cloud accounts from the MSP master connection
- Read the account record and Endpoint Security license counters for a managed account
- List managed devices, per-device protection status, and unmanaged devices discovered on the network
- Review managed security configurations by type (deployment, workstations and servers, Android, iOS)
- Check security event counters, the security overview (1, 7, or 30 days), and export security events of one type
- Read the company risk summary, detected risk factors, and per-device risk
- Start an immediate scan on explicit devices - with it_admins approval
- Isolate devices from the network or stop isolation - with it_admins approval
- Reboot devices and link devices to a managed configuration - with it_admins approval
- Uninstall WatchGuard protection (shipped disabled by default) - with it_admins approval when enabled
- Deploy as an MSP global app - one Service Provider credential, each customer confined to its WatchGuard Cloud account_id
Just ask Dex
Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.
Admin prompts
- >Which devices in WatchGuard are unprotected or have protection out of date?
- >Any malware detected this week? Show me the security overview for the last 7 days
- >How many Endpoint Security licenses are left on this account?
- >List the high-risk devices and the detected risk factors for this account
- >Isolate the device named "FIN-LAPTOP-014" from the network - it looks compromised
- >Start an immediate scan on SRV-BACKUP-02
Policy actions
Every action Dex can take on WatchGuard Endpoint Security is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.
| Action | What it does |
|---|---|
watchguard_list_managed_accounts | List WatchGuard Cloud accounts managed by the Service Provider (MSP master connection only) |
watchguard_get_account | Read this WatchGuard Cloud account record |
watchguard_get_licenses | Read Endpoint Security license counters for this account |
watchguard_list_devices | List Endpoint Security managed devices for this account |
watchguard_list_protection_status | List per-device protection status for this account |
watchguard_list_unmanaged_devices | List unmanaged devices discovered on this account's networks |
watchguard_list_managed_configurations | List Endpoint Security managed configurations for this account |
watchguard_get_security_event_counters | Read security event counters for this account |
watchguard_get_security_overview | Read the security overview for this account |
watchguard_export_security_events | Export security events of one type for this account |
watchguard_get_company_risk_summary | Read the company risk summary for this account |
watchguard_get_detected_risks | Read detected risk factors for this account |
watchguard_list_devices_risk | List risks detected per device for this account |
watchguard_immediate_scan | Start an immediate scan on devices of this account |
watchguard_isolate_devices | Isolate devices of this account from the network |
watchguard_unisolate_devices | Stop isolation on devices of this account |
watchguard_device_action | Reboot devices of this account |
watchguard_assign_configuration | Link devices of this account to a managed security configuration |
watchguard_uninstall_protection | Uninstall WatchGuard protection from devices of this account (disabled by default) |
How to configure WatchGuard Endpoint Security
Onboarding takes minutes. Dex validates your credentials before saving them.
Setup steps
- 1In WatchGuard Cloud, go to Administration > Managed Access on your Service Provider account and create API access.
- 2Use the Read-write Access ID (ends in _rw_id) if you want device actions to work; a read-only Access ID still serves every read but device actions return 403.
- 3Note the Access ID, access password, and API Key from the Managed Access page, plus your region (usa, deu, or jpn).
- 4In Dex, enable WatchGuard as an MSP-wide app and save the Service Provider credential on the MSP master connection with account_id left blank.
- 5Dex discovery reads the managed-accounts roster to map each Dex tenant to its WatchGuard Cloud account_id (e.g. WGC-1-123abc456 or ACC-1234567); Dex validates the credential with a live read before saving.
Credentials required
- access_id
- WatchGuard Cloud read-write Access ID (ends in _rw_id) for the Service Provider account; read-write is needed for device actions
- access_password
- Password paired with that Access ID from the Managed Access page
- api_key
- API Key from the Managed Access page, sent as the WatchGuard-API-Key header
- region
- WatchGuard Cloud region: usa (NA/Americas), deu (EMEA), or jpn (APAC)
- account_id
- This tenant's WatchGuard Cloud account ID (e.g. WGC-1-123abc456 or ACC-1234567); leave blank on the MSP master connection, set it on the tenant connection once discovered
Requirements
- •A WatchGuard Cloud Service Provider account with API access enabled and WatchGuard Endpoint Security on the managed accounts
- •A read-write Access ID for device actions - a read-only ID serves every read but device actions fail with 403
- •Admin-only: Dex Go is off, so there are no employee self-service workflows
- •MSP global app: one shared Service Provider credential, each Dex tenant confined to its WatchGuard Cloud account via account_id
Related integrations
Security & BackupSentinelOne
Bring your SentinelOne Singularity EDR into Dex - browse agents, threats, activities, and groups per customer Site in plain language.
Learn more →
Security & BackupCrowdStrike Falcon
Triage Falcon detections and respond to hosts conversationally - inventory sensors, isolate compromised machines, and run Real Time Response.
Learn more →
Security & BackupHuntress
Run Huntress managed security conversationally - fleet health, SOC-reviewed incident triage, usage and billing - without dashboard hopping.
Learn more →
See Dex run WatchGuard Endpoint Security
Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.