Who does what
Provider
- Investigate monitored signals
- Execute permitted endpoint isolation
- Hunt and report incidents
Your team
- Maintain product licenses and integrations
- Set contact hours and exceptions
- Complete remaining remediation
Coverage
- Endpoints
- Network
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Teams and MSPs with supported WatchGuard, Microsoft or CrowdStrike endpoints and several cloud data sources
Open is a specific tier
Supports listed WatchGuard and third-party tools with their required licenses and permissions.
Actions differ by connector
Endpoint isolation can be authorized. Duo monitoring does not include blocking or MFA reset.
Your MSP still has work
Maintain integrations and contacts, approve exceptions and complete escalated remediation.
Full service analysis
WatchGuard Open MDR investigates connected signals 24/7 and executes permitted endpoint isolation. You or your MSP maintain integrations, approve exceptions and handle remediation beyond the configured response actions.
- Your team owns
- License and maintain connected security products
- Set escalation hours and isolation exceptions
- Complete work outside enabled response permissions
Open is a specific tier
Open MDR supports WatchGuard, Microsoft Defender and CrowdStrike endpoints plus listed cloud, identity and firewall sources. It requires the corresponding licenses and permissions. Core and Total packages have different integration scope.
Actions differ by connector
Endpoint isolation requires authorization, with extra approval for configured exceptions. Duo integration is monitor-only and does not block accounts or reset MFA. Obtain a response matrix for every connected source.
Your MSP still has work
WatchGuard supplies investigation, hunting and remediation guidance. You or your MSP maintain integrations and available contacts, choose escalation hours and complete work outside granted response permissions. A portal login alone does not transfer daily IT operations.
Pricing & contract
$141.59 / 12-month license Indicative pricing from public research, not official provider pricing. Ask the provider for a current quote.
AWS Marketplace lists Open MDR at $141.59 for a 12-month license. The licensing guide allows one monitored endpoint per licensed user. Confirm quantity, underlying product licenses and partner charges before comparing quotes.
- Billing
- Per-user, Tiered
Tradeoffs & buying questions
Strengths
-
Supported existing endpoint tools can be retained
-
Connector documentation exposes license prerequisites
-
Endpoint isolation exceptions are configurable
Considerations
-
Monitoring does not imply response on every connector
-
Security product licenses remain prerequisites
-
Buyer or MSP must maintain contacts and complete escalated work
Ask before buying
- For each connected product, which actions will the SOC execute and which will our MSP perform?
- How will isolation exceptions and our chosen 8x5 or 24x7 contact schedule affect an incident?
- How many licensed users and endpoints do we need, and which product licenses and partner charges are additional?
Integrations
Endpoint
- WatchGuard Endpoint Security
- Microsoft Defender for Endpoint
- CrowdStrike Falcon Insight
Cloud
- AWS
- Microsoft Azure
Other integrations
- Microsoft 365
- Google Workspace
- Okta
2 more integrations
- Duo
- WatchGuard Firebox
Common questions
Can Open MDR block a compromised Duo account?
The documented Duo connector monitors authentication and administrator telemetry. It does not enforce account blocks or MFA resets.
Does one Open MDR license cover every user device?
The licensing guide specifies one monitored endpoint per licensed user. Confirm the count for people with multiple devices and shared systems.