Purpose
This guide explains how to configure the WatchGuard Firebox Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, manage exceptions to WatchGuard's blocked-site, botnet-site, geolocation, and file-hash blocking features via WatchGuard Cloud. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device. It manages allow/deny exceptions to policies already configured on your Firebox; it does not configure the underlying reputation/botnet/geo/file-blocking policies themselves.
Prerequisites
- A WatchGuard Cloud account with API access, managing the Firebox appliance(s) you want to control.
- WatchGuard Cloud API credentials: an API Key, an Account ID, an Access ID, and a Password.
- Use least privilege. If WatchGuard Cloud supports scoped API roles, grant only the permissions needed to manage exception lists rather than full account administration.
Step 1: Obtain WatchGuard Cloud API Credentials
- Log in to WatchGuard Cloud with an administrator account.
- Navigate to the API credentials / integrations area of WatchGuard Cloud (the exact menu path varies by WatchGuard Cloud version and was not independently verified during this research).
- Generate or note your Account ID, Access ID, Password, and API Key. Copy all four immediately and store them securely.
- Note which WatchGuard Cloud region your account is in (APAC, EMEA, or NA/Americas), since this determines the Region field in Logsign.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for WatchGuard Firebox, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this WatchGuard device in Logsign. |
| Region | Yes | The WatchGuard Cloud region your account belongs to: APAC, EMEA, or NA/Americas. |
| Api Key | Yes | The WatchGuard Cloud API Key from Step 1. Stored encrypted at rest. |
| Account Id | Yes | Your WatchGuard Cloud Account ID. |
| Access Id | Yes | Your WatchGuard Cloud Access ID. |
| Password | Yes | Password associated with the Access ID. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls to WatchGuard Cloud when enabled. Leave off unless you have a specific reason to keep it on. |
Click Create to save the device.
Available Methods
Blocked-site exceptions
- get_blocked_site_exceptions — lists current blocked-site exceptions.
- create_blocked_site_exceptions — adds a blocked-site exception.
- delete_blocked_site_exceptions — removes a blocked-site exception.
Botnet-site exceptions
- query_all_botnet_site_exceptions — lists current botnet-site exceptions.
- create_botnet_site_exceptions — adds a botnet-site exception.
- delete_botnet_site_exceptions — removes a botnet-site exception.
Geolocation exceptions
- query_all_geolocation_exceptions — lists current geolocation-blocking exceptions.
- create_geolocation_exceptions — adds a geolocation exception.
- delete_geolocation_exceptions — removes a geolocation exception.
File-hash exceptions
- query_all_file_exceptions — lists current file-hash exceptions.
- create_file_exceptions — adds a file-hash exception.
- delete_file_exceptions — removes a file-hash exception.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Api Key, Account Id, Access Id, or Password. | Re-enter all four credential fields exactly as issued in WatchGuard Cloud. |
| 403 Forbidden / 404 Not Found | Wrong Region selected (WatchGuard Cloud is regionally partitioned), or the account does not have access to the target Firebox. | Confirm the Region field matches the region your WatchGuard Cloud account and Firebox actually belong to. |
| 429 Too Many Requests | WatchGuard Cloud enforces API rate limits. | Reduce the frequency of automated calls, especially in high-volume correlation rules. |
| Exception created but blocking behavior does not change | The underlying reputation/botnet/geo/file-blocking policy itself is not enabled on the Firebox, or the exception was created against a different Firebox than expected. | Confirm the relevant blocking feature is enabled in your Firebox policy, and that this integration is scoped to the correct device/account. |
Notes and Limits
- These methods manage exception lists only, not the underlying blocking policies (reputation, botnet, geolocation, file-hash) themselves; those must already be enabled in your Firebox/WatchGuard Cloud policy configuration for the exceptions to have any effect.
- WatchGuard Cloud is regionally partitioned (APAC/EMEA/NA/Americas); selecting the wrong Region is a common source of connection failures even with otherwise-correct credentials.
- The exact WatchGuard Cloud navigation path for generating API credentials was not independently verified against a live account during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.