Connect WatchGuard Cloud

WatchGuard Cloud is WatchGuard's single management plane for its whole product line — Firebox firewalls, FireCloud, Endpoint Security, AuthPoint multi-factor authentication, WatchGuard NDR, and ThreatSync, the layer that correlates detections from all of them into one incident. It is also where your subscriptions, licenses and operators live. StackJack talks to it through WatchGuard's own public APIs, the same ones behind the console you already use, and covers all of them.

Connecting WatchGuard Cloud to StackJack gives your AI assistant a family of wg_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. With them, your AI can:

• Work ThreatSync incidents — list and read the correlated incidents WatchGuard raises across Firebox, endpoints and the network together, read the comment trail and the response history, and add to both
• Report on endpoints — device inventory, protection status, installed software, missing patches, license position, unmanaged devices found on the network, and the security events behind them
• Show risk — the company risk summary, which risk factors are detected and on how many devices, and how detections have trended over the period
• Follow up on work — the task history behind every scan, patch installation and IOC search, down to which devices a particular run reached
• Report on Firebox — the Executive and Security dashboards: what went through the firewall and what it blocked, which is exactly the material for a quarterly review
• Investigate the network — the WatchGuard NDR asset inventory with each asset's threat score, and the Smart Alerts raised against them
• Work across customers — list the accounts you manage and run any of the above against one of them
• Manage Firebox configuration — firewall policies, the exception lists (blocked sites, botnet sites, geolocation, files, intrusion-prevention signatures and WebBlocker), interfaces and branch-office VPN tunnels, the users and authentication servers a Firebox trusts, certificates, and the deployment that pushes saved changes out to the firewalls
• Manage FireCloud — the same exception families for WatchGuard's cloud-delivered firewall
• Handle subscriptions and licensing — your subscriptions and contracts, the product catalog, which customer a license is allocated to, and product activation
• Administer accounts and operators — partner portal accounts, the operators who sign in to WatchGuard Cloud, and the roles they hold
• Work with AuthPoint — read the multi-factor policy that applies to a user and drive the authentication flows themselves
• Check whether a WatchGuard service is up — one tool covers every WatchGuard service; pick the service you are asking about. It reports the service's own status, not whether your credentials still work
• Respond (on Pro plans) — run a ThreatSync response action, isolate an endpoint or return it to the network, start an immediate scan, restart a device, close a Smart Alert, and manage the accounts and assets themselves

How StackJack authenticates to WatchGuard Cloud

WatchGuard gives you three values rather than two: an Access ID, its Password, and a separate API Key. All three appear on the Managed Access page in WatchGuard Cloud once API access is switched on.

The Access ID and Password get StackJack a session. The API Key travels alongside it on every single request, and a request with a valid session and no API Key is refused. This is the one thing about WatchGuard that surprises people: the API Key is a different value from the Access ID, and putting the Access ID in the API Key box fails in exactly the same way as a wrong password.

Sessions last an hour and StackJack renews them for you. There is nothing to rotate on a schedule and nothing to re-authorize.

Pick your region

WatchGuard runs the Americas, Europe and Asia Pacific as separate services. Credentials issued in one are rejected by the others, and the rejection looks identical to a wrong password — so this is worth getting right first time.

Your region is in the base address shown on your Managed Access page. It carries one of three words: usa for the Americas, deu for Europe, jpn for Asia Pacific. Pick the matching option in StackJack. StackJack stores your choice rather than an address, so the connection cannot drift onto the wrong region later.

Steps

1. Turn on API access in WatchGuard Cloud. It is off until you enable it, and nothing below exists until you do — the credentials and the base address only appear afterwards. You need to be an account owner or administrator.
2. Open Administration, then Managed Access. This one page carries everything you need.
3. Copy the Access ID and Password. WatchGuard issues read-write and read-only pairs. Choose read-only if you only want reporting. Choose read-write if you want your assistant to close incidents, isolate endpoints or manage accounts — a read-only pair refuses every write no matter which tools you allow.
4. Copy the API Key. Same page, different value. Check it twice.
5. Note your account ID. It looks like ACC-1234567 or WGC-1-123abc456. StackJack checks the connection by reading this account back, and it is the starting point for finding the accounts you manage.
6. Enter everything in StackJack. Open Connectors, choose WatchGuard Cloud, paste the Access ID, Password, API Key and account ID, pick your region, and run Test Connection. StackJack checks all of them together, so a failure means one of the five is wrong.

What to know before your AI uses this connector

Working across the accounts you manage

If you are a Service Provider, every WatchGuard tool takes an optional account ID. Leave it out and the tool works on your own account; supply one and it works on that customer's.

WatchGuard asks for permission per account before StackJack can act on one, and StackJack does that for you and holds a separate session per account — so one customer's session can never be used for another customer's request. The practical effect is only that the first call to a new customer is slightly slower than the rest.

Start with the managed-accounts list. It is the only place those account IDs come from, and it is a Free-tier read.

Some tools change live security

These need the Pro tier and are marked destructive, which means your AI application may ask you to confirm before running one — whether it does depends on that application's own settings. See Destructive tools and confirmation.

• Isolating an endpoint takes the machine off the network. It is the right answer to a live compromise and the wrong answer to almost everything else: shared drives, line-of-business applications and remote access all stop, and the person using it notices within seconds.
• Stopping isolation is also marked destructive, and deliberately. It reads like an undo, but the machine was quarantined because something was found on it, and putting it back before that is resolved re-exposes the network.
• Uninstalling protection leaves a device unprotected and no longer reporting. Re-protecting it means building an installer and running it on the machine.
• A ThreatSync response action runs real remediation — blocking, quarantining, stopping a process — on live systems, and there is no undo.
• Restarting a device closes whatever the person at the keyboard had open. Use the countdown.
• Deleting a managed account removes that customer's whole tenancy, and there is an option that removes every account beneath it as well. This is the most dangerous thing in the connector.
• Deploying a Firebox configuration is the moment changes reach real firewalls. Everything else you edit on a Firebox is saved in WatchGuard Cloud and changes nothing until this runs — which is also why the deployment is the call to be careful with, not the edit before it.
• Installing a certificate replaces what your firewalls present to clients, and adding one stores a private key in the account.
• Creating or updating an operator grants someone access to WatchGuard Cloud and emails them. Updating one can also raise the role they already hold.
• Creating a portal account provisions a real partner account and emails its first user.
• Activating products consumes activation keys against serial numbers. WatchGuard publishes no way to reverse it.
• Setting a Firebox's template subscriptions unsubscribes it from every template you leave out — an empty list unsubscribes it from all of them.

Starting a scan is the exception: it creates a scan task and destroys nothing, so it is not marked destructive. It is the safest first response to a suspicion. It does use the devices' processors while it runs, so an estate-wide scan during working hours will be noticed.

Some updates replace the whole record

Updating a managed account, a WatchGuard NDR asset, the endpoint risk configuration, a firewall policy, an exception, a branch-office VPN tunnel or a deployment's schedule replaces what is stored rather than merging into it. A field left out is cleared, not kept, and for the risk configuration a factor left out of the list stops being reported at all — so the posture looks better while nothing has changed on any device.

Ask your assistant to read the current record first and send it back complete with only the intended change. Each of these tools says so in its own description.

Closing a Smart Alert is worth one more look. It is ordinary triage and is not marked destructive, but two of its options change what happens in future: one authorizes the activity so similar traffic stops raising alerts, and another closes every matching alert at the same time. Leave both alone unless you mean them.

Some answers contain secrets

A handful of WatchGuard records carry a working credential inside them, and WatchGuard returns the whole record. Reading your Firebox users returns their passwords. Reading a branch-office VPN tunnel returns its pre-shared key — and so does creating, changing or deleting one, because WatchGuard answers those with the tunnel it just saved or removed. Certificates behave the same way and can carry a private key. Networks can carry a broadband or dynamic-DNS password, activation records carry a redeemable license key, and a content-filtering rule can carry its override password.

StackJack knows which tools those are and keeps their answers out of the places results are otherwise kept: they are never saved to a file and handed back as a link, and they are never recorded for troubleshooting. What StackJack cannot control is what happens after your AI application receives the answer. Treat a reply from one of those tools the way you would treat the password itself — do not paste it into a ticket, a chat channel or a document. Each of those tools says so in its own description.

Reports come one view at a time

The Firebox dashboards return one view per call — top blocked countries, top applications, and so on. Ask for the views you want in turn rather than expecting one call to return the whole dashboard.

Tool reference

See the generated WatchGuard Cloud tool reference for the current inventory, plan assignment, input schemas, and destructive-action labels.

WatchGuard publishes no rate limit for its API, so StackJack paces requests conservatively on its own and backs off when WatchGuard asks it to, which usually makes a wide report slower rather than failed. Pacing smooths a burst; it does not guarantee that every call arrives. Gathering a report across many managed accounts at once is the shape most likely to meet it, because each account needs its own session — ask for one account at a time. Narrow the read, honour any retry delay the vendor sends, and check whether a write landed before repeating it — see Retrying a failed or timed-out write.

Large lists are returned in pages of up to 100 records. Some WatchGuard reads stop at 3,000 records however you ask, so narrow by device, date or search text rather than paging through an entire estate.

Most of the Firebox and FireCloud configuration lists are the exception: WatchGuard offers no paging on them, so a list returns the whole collection in one answer, and StackJack does not invent a page size WatchGuard would ignore. The current Firebox exception lists are the ones that do page, with a row limit and a "start after this exception" marker. On a large firewall a policy or network list can be big enough that StackJack hands your assistant a temporary download link instead of the text — ask for one Firebox at a time where you can.

Troubleshooting

"Credentials rejected" or a sign-in failure. Check the API Key box first — it is a different value from the Access ID, WatchGuard needs both on every request, and the two mistakes look identical. Then check the region matches the base address on your Managed Access page. Re-copy all three values before re-issuing anything.

Reads work, writes are refused. You copied the read-only pair. A read-only credential refuses every write no matter which tools you allow in StackJack. Copy the read-write pair from the Managed Access page instead.

A managed account is refused. Check the account ID came from your managed-accounts list rather than being typed by hand, and that it is an account you actually manage. An account that has been moved to a different Service Provider stops being reachable immediately.

Nothing works and the credentials look right. Confirm API access is still enabled in WatchGuard Cloud. It can be switched off, and when it is, the credentials stop working without changing.

Changing the region asks for the secrets again. That is deliberate. Every value is required each time you save this connector, so a save can never quietly replace a stored key with a blank one.

WatchGuard Cloud tools

wg_ · 232 tools · Free 130 · Pro 102

ThreatSync Incidents

ThreatSync Response Actions

Endpoint Devices and Inventory

Endpoint Isolation

Endpoint Risk and Security Events

Endpoint Tasks

Accounts and Managed Accounts

Firebox Reports

NDR Assets

NDR Smart Alerts

Platform

Firebox Deployments

Firebox Authentication

Firebox Exceptions

Firebox Networking

Firebox Policies

Firebox System

FireCloud Exceptions

Product Catalog

Subscriptions and Orders

Licenses and Allocations

AuthPoint MFA

Operators

Portal Accounts

Activations