I’m starting my journey toward the WatchGuard Essentials certification, and I want to make sure I’m going about this the right way. I’ve been in network security for a couple of years, but this is my first time attempting a WatchGuard-specific exam.

I’m curious—how deep does the exam go into practical configuration versus theoretical knowledge? Should I be spending more time in the lab environment, or is the written content just as important?

I’ve used the practice tests from removed and it seems promising, but I want to supplement it with other strong resources or study tips from people who’ve already passed.

Also, any insights on tricky topics or common pitfalls would be hugely appreciated.

Thanks in advance for your guidance!

Since then, each time I try to save a configuration in WSM, I get the wollowing error message : the os version of the firebox or configuration file does nos support threat detection & response. These settings will be removed. Do you want to continue?

I didn't press yes for now, because I dont want to loose the TDR config. So I can't make any change from now on on the Firebox configuration untill I find a solution to that, which is a big problem.

Does someone has any idea about what might have caused this? What are the solutions?

Also, can we run EPDR concurrently with existing TDR?

Thanks.

We have received a TDR alert, the details of which are below :

We checked in the path C:\Users\administrator\AppData\Local\Temp\
But we couldn't find the folder \16d5bcc8-ae6e-4622-81ae-81718dfc9bc1\certutil.exe

Is it a false positive or is it a virus ?
Do you have any idea ?

Thanks.

I would like to know if there are good practices for setting exclusions in the TDR or can I follow the product manufacturer's documentation.

Link:

Brgds.

Marcelo Rocha

I have a client who has had two computers so far get contained because TDR flags Zoho Assist executables as threats. This problem started last July. One of the computers was a rarely-user training computer, so it being offline for months was not unusual. I repurposed it a month ago, and it would not connect, and that is when I found the Zoho Assist problem and added all of the exclusions below the one that happened today as noted below. The latest one was today and it was:

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent.exe

I already had the following in the exception list and I just added the one above to the list. I am tempted to just allow the whole "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting" folder and subfolders to stop this false positive, but that's not the best solution.

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Temp\ZA_Delta\agent_ui.exe

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent_ui.exe

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZMAgent.exe

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe

What is really strange is that there are three computers that have Zoho Assist on them, but only two that ever get contained.

Gregg

Over the last months I have seen the TDR agent using a lot of memory on my devices causing all kinds of performance problems. Has something changed in the way it works?

If I have 2 x Firebox M290 where each of them has 75 TDR License.
Can I combine that licenses into one system so i can mange 150 tdr licenses?

Given the recent events in Ukraine and the cyber-attacks from Russia, a question arises about eventual links between WatchGuard and Kaspersky. Indeed, Kaspersky Labs mentions WatchGuard as a partner [1]. It states that WatchGuard uses Kaspersky Anti-Virus SDK.

So, in my organization, we have some concerns about the fact that some WG products may use components whose supply is potentially under Russian control, therefore causing a high risk of supply chain attack.

The questions are then :

• How can we get sure no Kaspersky component is still in use on WG products ?
• Can WG guarantee this and provide evidences or ways to check for this ?

If we cannot get sufficient guarantee that it does not use any library originating from Kaspersky, we may consider withdraw all our WatchGuard products...

References
[1] https://www.kaspersky.com/partners/technology

Many thanks.

I'm trying to decided if to enable the APT Blocker feature in TDR?
What are the pros and cons of enabling it?
Is it generally recommended best practice to enable it and why its not enabled by default?

Many Thanks

I have a PC running Windows Defender that keeps flagging this Trojan, but yet the active TDR Host Sensor flags nothing.

Because of this I'm assuming that Windows Defender is flagging this as a false positive, but in our crazy world one can ever be too sure.

https://answers.microsoft.com/en-us/protect/forum/all/what-to-do-about-trojanwin32wacatacbml-false/d884df80-2dba-46c9-bd8b-4e2f93c9dd3f

Has anyone else seen or ran across this?

Thanks!

• Doug

from 29/12/2021 on my TDR I get this message:

Trouble (Failed to configure malicious md5 list Downloaded MD5 list failed MD5 check FailureCode = 43)

Some idea ?

I am reading this:
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_deploy_tips_c.html

Under Recommended Host Sensor Settings for Best Performance Allow Host Sensors to Cache File Metadata and Allow Host Sensors to Cache Process Connection Metadata is set to OFF.

What is the security impact of disabling cashing of those 2 options?
Will detection be slower if off?

Regards
Robert

Have you ever installed a TDR agent on a Macbook without the use of JAMF?
I am trying to do so using the terminal but have failed so far.

Please let me know.
Thank you for your help.

kLevi

I am in the process of changing my TDR clients Account UUID. This is done by this script:

net stop /y TDRSensorService64 >> "c:\temp\NewTDR.txt"
"c:\Program Files (x86)\WatchGuard\Threat Detection and Response\amd64\host_sensor.exe" /setAccountUUID=KEY >> "c:\temp\NewTDR.txt"
net start TDRSensorService64 >> "c:\temp\NewTDR.txt"

It works, the client is afterwords configured in the new portal account, i have. The issues i see, is with the Enable Users to Pause Host Sensor Protection and Prevent Host Sensor Service Changes.
Both options is set to not allow the user to pause and stop the service, but even after a reboot then end user is still able to pause and stop services.

It worked before i changed the UUID account.

I have not checked whether the other options also is affected.

Any clue?

Regards
Robert

Anybody here using TDR on a Veeam server ascting as a repository and as a mount server for restore points when trying to restore data?

I have a issue where TDR somehow breaks the Veeam mounting service when trying to mount a store point and only by pausing the TDR client, Veeam works.

Support says TDR will not work with Veeam when trying to mount restore points and only solution is to either pause TDR client or stop using TDR on the server(s).

/Robert

It is going to get to the point where ANYTHING that auto-updates can be a threat.

I cannot wait to retire!

I was wondering if there are any out there on the vast shores of the ether. That is using the TDR on Ubuntu servers? I know it is supported out for the box on Red hat, curious to know if some have managed to deploy it on Ubuntu servers.

if so
Any issues while installing/configuring up the sensor?
is it stable over time?
Any caveats?

Regards
Robert

dcc

I am testing a new product which can detect and prevent encryption of files. The product seems to work and detects a encryption is in process and after 3 files has been encrypted, it will kill the process.

Now TDR has a signature for the file MD5 hash (3B1B33770C1AC6DBB35E3810F40FD9B6). So for a test i have disabled "the other product" to see how effective TDR is.

I am at cybercon level 3 and every option is ON exept Allow Baselines on Host Sensors
and Enable Kernel Host Containment Action.

If i run a encryption test of files, 96 files will get encrypted before TDR detects it and quarantine the file. How come it takes TDR so long before stopping the process?

I have also seen TDR failure to quarantine the file which also doe snot makes sense to me.

Youtube has a video how to test:
https://www.youtube.com/watch?v=qiBpdxoxhXU

Roebrt

All my TDR hosts is reported as "host sensor is not communicating" in the cloud interface. Is it just me or do others also see this issue?

/Robert