Security & Backup

Webroot

Run your Webroot endpoint protection conversationally - list endpoints, see what is infected, read threat history, and remediate with approval.

Dex connects to the Webroot Unity API (GSM Console) so admins can run endpoint protection from the conversation - list a site's endpoints and see which are infected right now, read threat and command history, and review groups, policies, and admins. Remediation actions like running a scan or cleanup, deactivating or reactivating endpoints are policy-gated and require approval. Webroot is an MSP global app: one shared GSM OAuth credential set covers every Site in the Global Site Manager, and each Dex tenant is confined to its own Webroot Site via its SiteId GUID. Admin-only - there is no end-user self-service.

Start free →

What Dex does with Webroot

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

List a site's endpoints and filter to the machines that are infected now, with last-infected times
Look up a single endpoint by id - host name, group, policy, last seen, agent version, isolation status
Read site-wide threat history over a date range (up to 3 months), including file names, malware group, and determination
Review agent command history to confirm a scan or cleanup actually ran
List endpoint groups, site policies, and site admins
Run agent commands - scan, cleanup, restart, or uninstall - on listed endpoints, with approval (disabled by default)
Deactivate or reactivate listed endpoints, with approval
Deploy as an MSP global app - one shared GSM credential set, each customer confined to its own Webroot SiteId GUID

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Which machines in this site are infected right now?
>Show me the threat history for this site over the last two weeks
>Look up the endpoint named "FIN-LAPTOP-014" - what policy and group is it in?
>Run a scan on endpoints id1 and id2, and tell me when it has run
>List the endpoint groups and policies for this site

Policy actions

Every action Dex can take on Webroot is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`webroot_list_sites`	List Webroot GSM sites (MSP master connection only)	—
`webroot_get_site`	Get one Webroot site by site_id	—
`webroot_list_site_groups`	List endpoint groups for this site	—
`webroot_get_site_group`	Get one endpoint group by group_id	—
`webroot_list_site_policies`	List policies for this site	—
`webroot_list_site_admins`	List admins for this site	—
`webroot_list_endpoints`	List endpoints for this site, including InfectedNow and LastInfected	—
`webroot_list_group_endpoints`	List endpoints of one group in this site	—
`webroot_get_threat_history`	Read site-wide threat history	—
`webroot_list_commands`	Read site-wide agent command history	—
`webroot_get_endpoint`	Get one endpoint by endpoint_id	—
`webroot_list_gsm_policies`	List GSM-wide policies (MSP master connection only)	—
`webroot_endpoint_command`	Run an agent command (scan, cleanup, restart, uninstall) on listed endpoints	approval
`webroot_deactivate_endpoints`	Deactivate listed endpoints (frees a seat, drops protection)	approval
`webroot_reactivate_endpoints`	Reactivate listed endpoints	approval
`webroot_change_endpoint_policy`	Change the policy of listed endpoints (MSP master only)	approval
`webroot_move_endpoint_group`	Move listed endpoints to another group (MSP master only)	approval
`webroot_create_site`	Create a GSM site (MSP master connection only)	approval
`webroot_suspend_site`	Suspend a GSM site (MSP master only; disabled by default)	approval
`webroot_resume_site`	Resume a GSM site (MSP master connection only)	approval

How to configure Webroot

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the Webroot GSM Console, confirm you have a console user with Console.GSM API access and note the GSM keycode.
2
Obtain your Unity API OAuth client id and client secret from Webroot.
3
In Dex, enable the Webroot integration and paste the console user email and password, the OAuth client id and secret, and the GSM keycode.
4
Leave site_id blank on the MSP-master connection; Dex uses it to list sites and map each tenant to its SiteId GUID.
5
On each tenant connection, set site_id to that customer's Webroot SiteId GUID so every call is confined to that site.

Vendor documentation ↗

Credentials required

username: GSM console user email with Console.GSM API access
password: GSM console user password
client_id: Unity API OAuth client id from Webroot
client_secret: Unity API OAuth client secret issued with the client
gsm_key: GSM console keycode, required on every connection (e.g. FADC-2638-E5C1-4EA9-90F5)
site_id: This tenant's Webroot SiteId GUID - leave blank on the MSP-master connection, set on each tenant connection for per-site isolation

Requirements

•A Webroot GSM console user with Console.GSM API access
•A Unity API OAuth client id and secret from Webroot
•Policy changes and group moves are MSP-master only - they are refused on a scoped child tenant
•Site create, suspend, and resume are MSP-master only; endpoint command and site suspend are disabled by default
•Admin-only - Dex Go self-service is not available for Webroot