Skip to main content
Antivirus & security

WatchGuard EPDR

Monitor the services, protection modules and knowledge catalogue of locally installed WatchGuard EPDR protection on Windows devices.

The WatchGuard EPDR check monitors locally installed WatchGuard endpoint protection (formerly Panda Adaptive Defense) on Windows devices. It checks installation, automatic services, antivirus and Advanced Protection, and the age of the knowledge catalogue, and runs every 15 minutes by default.

Prerequisites

  • You need the Monitoring Check Management permission.
  • The target must be a Windows device with a connected octoja agent and WatchGuard EPDR, EDR, EPP, or a supported predecessor Panda product.

Steps

  1. Go to Devices and open the Windows device.
  2. Open Checks, click Add Check, and select WatchGuard EPDR.
  3. Under Knowledge catalogue warning age (hours), set the age at which the check warns.
  4. If needed, enable Show advanced options and adjust Query timeout (seconds).
  5. Click Add Check.

After the first interval, the result shows the product and version, service states, protection modules, and knowledge-catalogue age where WatchGuard provides those values locally.

Settings

FieldTypeRequiredDefaultDescription
Knowledge catalogue warning age (hours)IntegerNo48Warns when the last refresh is older than this value; critical above three times the value
Query timeout (seconds)IntegerNo60Maximum duration of the local status query. Visible only when Show advanced options is on. Values from 1 to 9 are raised to 10, and 0 or less uses 60.

Results

ConditionResult
No supported product, associated service, or local diagnostic is foundCritical
An automatically starting product service is not runningCritical
A product is detected but no associated services are foundWarning
The antivirus module is reported inactiveCritical
Advanced Protection is reported inactiveWarning
Knowledge catalogue is older than the configured valueWarning
Knowledge catalogue is older than three times the configured valueCritical
The local query times out or failsFailure

Stopped services that are not configured for automatic start are displayed but do not alert. Other active protection modules are also displayed but not evaluated.

Missing optional module or freshness data does not trigger an alert by itself. The check evaluates only values supplied by the local installation.

Was this helpful?

Still need help? Ask the team