WatchGuard Fireware OS

The IBM® QRadar® DSM for WatchGuard Fireware OS can collect event logs from your WatchGuard Fireware OS.

The following table identifies the specifications for the WatchGuard Fireware OS DSM:
Table 1. WatchGuard Fireware DSM specifications
Specification Value
Manufacturer WatchGuard
DSM name WatchGuard Fireware OS
RPM file name DSM-WatchGuardFirewareOS-QRadar-version-Build_number.noarch.rpm
Supported versions Fireware XTM OS v11.9 and later
Event format syslog
QRadar recorded event types All events
Automatically discovered? Yes
Includes identity? No
More information WatchGuard Website (http://www.watchguard.com/)
To integrate the WatchGuard Fireware OS with QRadar, use the following steps:
  1. If automatic updates are not enabled, download and install the most recent versions of the following RPMs from the IBM Support Website onto your QRadar Console.
    • DSMCommon RPM
    • WatchGuard Fireware OS RPM
  2. For each instance of WatchGuard Fireware OS, configure your WatchGuard Fireware OS appliance to enable communication with QRadar. You can use one the following procedures:
  3. If QRadar does not automatically discover the WatchGuard Fireware OS log source, create a log source for each instance of WatchGuard Fireware OS on your network. For more information about configuring the log source, see Syslog log source parameters for WatchGuard Fireware OS.