Watchguard Firewall

WatchGuard Firewall protects private networks from unauthorized users on the internet. In Logpoint, WatchGuard Firewall enables you to collect and normalize WatchGuard Firewall logs and lets you analyze the information through the LP_Watchguard Firewall dashboard.

Release Details

Version: 5.2.2

Release Date: April 11, 2025

Supported On: Logpoint v7.4.0 and later

SHA 256: 5c7c07d0eac69e15fb7ffeb21298a9a5c8eda1df7ab461962622874e7b2a5abd

Documentation: Watchguard Firewall Guide

Download

Bug Fix

Description	Issue ID	Reference ID
The host field in WatchGuard Firewall logs wasn’t normalized because normalizers failed to parse unexpected log patterns. Go to Expected Log Samples for details on the expected patterns.	PLUG-15820	84773

Past Releases

WatchGuard Firewall v5.2.1

Version: 5.2.1

Release Date: March 25, 2025

Supported On: Logpoint v7.4.0 and later

SHA 256: a328fa2639b6ccf9675b6fb7788ce1b8be02c7d28fddae2a6b0030e8c857909f

Documentation: Watchguard Firewall Guide

Download

Bug Fix

Description	Issue ID	Reference ID
Logs were not normalized because normalizers failed to parse unexpected log patterns.	PLUG-15717	86117

WatchGuard Firewall v5.2.0

Version:5.2.0

Release Date: May 02, 2024

Supported On: Logpoint v7.4.0 or later for log source template

SHA 256: 2c4f585e3693fb71f88050029da8dd0727c81c1a9b650d48e4c088c4c1569995

Documentation: Watchguard Firewall Guide

Download

Enhancement

Description	Issue ID	Reference ID
Added Syslog Collector based WatchGuard log source template, simplifying the log source configuration process. To learn more, go to Creating Log Source via a Template.	KB-22646	-

WatchGuard Firewall v5.1.2

Release Date: October 02, 2023

Supported On: Logpoint v6.7.4 or later

Download: WatchguardFirewall_5.1.2.pak

SHA256: 8756c68f0b7f91c54181dc353d9ebd761bb6d386a674bb727f7a44dbf76adfb3

Enhancement

Description	Issue ID	Reference ID
Added LP_Watchguard System Manager normalization package to normalize Watchguard System Manager logs.	KB-17982	-

Bug Fixes

The following issues are fixed:

Description	Issue ID	Reference ID
Some WatchGaurd logs were not normalized by WatchGaurdCompiledNormalizer.	KB-21066	-
The source_address and destination_address fields were missing in some WatchGuard logs.	KB-19432	-

WatchGuard Firewall v5.1.1

Release Date: Jan 6, 2023

Download: WatchguardFirewall_5.1.1.pak

SHA256: e68db555a008e792231b380162b0a2a91c42cf5f96f46e043307ef8ac1d4e2ab

Enhancements

Description	Issue ID	Reference ID
Added LP_Watchguard WifiCloud normalization package to normalize Watchguard WifiCloud logs.	KB-16486	65348
Added new labels in WatchguardCompiledNormalizer for Watchguard v12 logs based on the message_ID. To learn more, go to Watchguard Labels.	KB-16499	65410
Added signatures in LP_Watchguard Firewall to normalize Watchguard logs.	KB-16555	65620

WatchGuard Firewall v5.1.0

Enhancements

Description

Issue ID

Reference ID

Added new signatures in WatchguardCompiledNormalizer
for the Watchguard events with the message IDs 30000148 and 30000149.

KB-14061

59292

Added the following taxonomies:

Watchguard Firewall Field	LogPoint Field
geo_src	source_country
tls_profile	ssl_version
tls_profile	ssl_profile

Added new signatures in LP_WatchguardFirewall and WatchguardCompiledNormalizer
to support the Watchguard v12 logs for LogPoint UEBA.

KB-15870

63142

Bug Fix

Description	Issue ID	Reference ID
Some Watchguard FW/IPSlogs were not properly normalized.	KB-13491	57266

WatchGuard Firewall v3.4.0

Release Date: May 14, 2020

Download: WatchguardFirewall_3.4.0.pak

SHA256:e69f6c0a469e49f7f95824bfa891f738401e00d0fa5efe731c369a4bf83be3df

Enhancement

A minor update has been done in the WatchGuard Firewall's normalizer for better signature handling.

Support

If you have any questions or require assistance, create a support ticket.