Overview

WatchGuard Cloud Inspector (Labs)

WatchGuard Cloud is WatchGuard's management platform for Firebox firewalls, Wi-Fi access points, WatchGuard Endpoint Security, AuthPoint, and FireCloud. Service Providers use it to manage every Customer's WatchGuard products from one portal. The WatchGuard Cloud Inspector (Labs) connects to your Service Provider account through the WatchGuard Cloud APIs, finds every Customer account you manage, and reports each Customer's Fireboxes, access points, endpoint protection, licences, and operators back into Liongard, without logging in to WatchGuard Cloud Customer by Customer.

This Inspector is separate from the WatchGuard Inspector, which connects to a single Firebox over SSH and reports its full local configuration. Use both together: WatchGuard Cloud for fleet-wide inventory, licensing, and endpoint protection, and the WatchGuard Inspector for deep per-Firebox configuration.

What you can monitor

For your Service Provider account:

• Every Customer account you manage, including delegated accounts
• Licence allocations per Customer account, with quantities, usage, and expiration dates
• Your own WatchGuard Cloud operators and their MFA state

For each Customer account:

• Fireboxes, FireClusters, and access points with model, serial number, Fireware version, connection state, cloud-managed or locally-managed, and public IP
• Firebox and access point licence expirations
• WatchGuard Endpoint Security devices with platform, OS, agent version, last connection, licence status, isolation state, and protection status
• Endpoint licences
• The account's operators and their MFA state

How it works

You set up one Parent Inspector with API credentials from your WatchGuard Cloud Service Provider account. Each run, the Parent finds the Customer accounts you manage and creates one Child Inspector per Customer account, plus one for your own account (your own Fireboxes and endpoints, mapped to your MSP's Environment). The Inspector is read-only. If you're not a WatchGuard Service Provider, use your own account's API credentials: the Parent then creates one Child Inspector for that account.

Benefits

• Know when a Customer's Firebox goes offline, its firmware changes, or a Firebox or access point licence is about to expire.
• Find endpoints that are unprotected, isolated, unlicensed, or haven't checked in for a week.
• Audit WatchGuard Cloud operators without MFA, in your own account and every Customer account.
• See every Customer's licence allocations and expiration dates in one place for renewals and QBRs.

The Inspector ships with 13 alert rules, listed in the WatchGuard Cloud Inspector Summary. All rules ship turned off. To receive these alerts, turn the rules on under Admin > Actionable Alerts.

Inspector Setup Preparation

Step 1: Enable API Access in WatchGuard Cloud

1. Log in to WatchGuard Cloud.
2. From Account Manager, select My Account (your Service Provider account, not a Customer account).
3. Select Administration > Managed Access.
4. Click Enable API Access. If API access is already enabled, skip to step 8 and use the existing values.
5. Specify a readwrite password and a different readonly password (at least 12 characters with a lowercase letter, uppercase letter, number, and symbol; no <, >, emojis, or spaces).
6. Select the I agree to the terms and conditions in the WatchGuard APIs License Agreement check box.
7. Click Save.
8. Copy the Access ID (Read-only) and the API Key, keep the read-only password, and note the region in the API URL (base).

Inspector Setup:

Step 2: Configure the WatchGuard Cloud Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the WatchGuard Cloud Inspector > Select Add System.

Since WatchGuard Cloud is a multi-tenant system where one Service Provider account manages many Customers, you'll set up a single Parent Inspector that will then auto-discover a Child Inspector for each Customer account.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [MSP Name] WatchGuard Cloud Parent
• Agent: Select the On-Demand Agent. A Self-Managed Agent also works if it has outbound HTTPS access to api.usa.cloud.watchguard.com, api.deu.cloud.watchguard.com, or api.jpn.cloud.watchguard.com
• Inspector Version: Latest
• Region: North America / Americas (api.usa), EMEA (api.deu), or APAC (api.jpn)
• Account ID: From the My Account page
• Access ID (Read-only): From Administration > Managed Access
• Read-only Password: The read-only password set when API access was enabled
• API Key: From Administration > Managed Access
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 3: Child Inspector Setup

After the first run of the Parent Inspector, your WatchGuard Cloud Customer accounts will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > WatchGuard Cloud page. Customer accounts added later appear after the next Parent run.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

Troubleshooting

• WatchGuard Cloud rejected the Access ID or password: The Access ID or read-only password is wrong, or API access was revoked or its passwords changed. Check Administration > Managed Access in My Account, and confirm the Region matches the API URL shown there.
• The Account ID or API Key does not match these credentials: The three values come from different accounts. Copy all three from the same WatchGuard Cloud account.
• Daily WatchGuard API quota exhausted: WatchGuard allows 200,000 requests per day per API key, shared with every other integration on the same key; the quota resets at 00:00 UTC. Check See API Usage in WatchGuard Cloud. The Inspector uses about 10 requests per Customer account per run.
• A Customer account is missing from Discovered Systems: Only accounts your Service Provider account manages directly, or that were delegated to it, are visible. Delegation works only within one data region, and Customer accounts delegated to one of your own sub-Service Provider accounts aren't visible.
• A table shows under Skipped Collections: The Customer doesn't have that product (for example, no Fireboxes or no WatchGuard Endpoint Security). The rest of the run succeeds, and the related counts stay empty instead of showing 0.
• The Endpoints tab is empty for a Customer with WatchGuard endpoint protection: The Customer is on the older Aether-based platform. This version reports WatchGuard Endpoint Security only.
• Fireboxes have no policy, VPN, or interface details: Expected. Add the WatchGuard Inspector for per-Firebox configuration.
• No AuthPoint users or tokens: Expected. WatchGuard's public API doesn't expose them; AuthPoint licence allocations appear on the Parent.

Inspector FAQs