Knowledge Base Digest - March 2023

Articles Host Sensor upgrade to Endpoint Security Install WatchGuard Endpoint Security products on macOS with Jamf Pro 10.x Log Search page in WatchGuard Cloud does not show log data from before October 2022 Network to Endpoint correlation requires Internet traffic for at least 10 minutes TDR AD Helper end-of-life ThreatSync behavior for Fireboxes v12.8x, v12.9x, with logging and reporting enabled or disabled Traffic Management in Fireware OS v11.8.x and Lower Known Issues Archived filter on the Incident Timeline is not applied to the incident list Block IP action on Incident Details page does not always change the status Cannot manage T80 with 4G/LTE module installed False ThreatSync incidents created for APT Blocker clean file responses Filters with both an action and action status do not show expected incidents Firebox IP address presented for the Block IP action in ThreatSync incidents detected on incoming connections Firebox IPv6 incident does not correlate with endpoint Firebox M4600 might reboot 3 times on initial startup Firebox VPN enforcement fails after TDR upgrade to WatchGuard Endpoint Security Hash and URL certificate encoding is not supported for BOVPN certificate negotiation If the IP address of an endpoint changes, the correlation temporarily breaks Inaccurate incident and record count on Incidents page with some filters Incident Details page does not show process information for some incidents Incidents for FireClusters show the cluster member name instead of the FireCluster name Internal error in WatchGuard Cloud Log Manager and Log Search pages Invalid risk in EDR Core (Advanced protection for Windows disabled or in 'Audit’ mode) NOT operator does not work in the WatchGuard Cloud Log Search page Number of records returned on the Incident page is limited to 1000 Origin IP address for Remote Desktop connections via RD Gateway detected as "::%16777216" Overview page opens instead of the Automation Policies page for an inherited policy Process or fil