Webroot Monitoring

Webroot monitoring Direct link to this section

Arctic Wolf® can use Webroot APIs to monitor Webroot logs and alert you about suspicious or malicious activity.

To implement this monitoring, you must provide the following information about the Webroot Global Site Manager (GSM) console to Arctic Wolf:

• The username and password of a new administrator in your Webroot GSM console, such as monitoring@example.com
• The Client ID and Client Secret of your Webroot GSM console
• The Webroot Site Keycode and Webroot GSM Keycode for the site you that wish to monitor

Requirements Direct link to this section

• A Webroot GSM console account with Super Administrator permissions

Configure Webroot monitoring Direct link to this section

1. Convert your GSM console to the Managed Service Provider Console.
2. Create Webroot API client credentials.
3. Retrieve the Webroot site keycode.
4. Retrieve the Webroot GSM keycode.
5. Create a new administrator for the Arctic Wolf Sensor.
6. Provide credentials to Arctic Wolf.

Step 1: Convert your GSM console to the Managed Service Provider Console Direct link to this section

Webroot requires that you use the Managed Service Provider (MSP) Console to access their API. Arctic Wolf uses this API to retrieve security information.

If you are already using the MSP Console, proceed to Create Webroot API client credentials. Otherwise, convert your console to the MSP Console:

1. Sign in to the Webroot admin console using the credentials of a GSM Super Administrator.

2. From the navigation bar, select Settings, and then:

   • If Advanced Settings appears — Select Advanced Settings.
   • If API Access appears — You are already running the MSP console. Proceed to Create Webroot API client credentials.

3. From Advanced Settings, select Convert.

4. In the dialog box, select the checkbox to indicate that you understand that this is an irreversible operation, and then select Convert Console.

5. Read through or skip the MSP Console tutorial:

   • Select Next on all pages that appear.
   • Select Skip to skip the tutorial.

Step 2: Create Webroot API client credentials Direct link to this section

1. Sign in to the Webroot admin console.

2. From the navigation bar, select Settings, and then select the API Access tab.

3. Select New to create a new API credential.

4. Fill out the Name and Description fields, and then select Create.

5. Copy the Client ID and Client Secret values to provide to Arctic Wolf later.

   Note: The Client Secret value is only displayed once.

6. Select I Have Made Note Of The Client Secret to close the dialog box.

Step 3: Retrieve the Webroot site keycode Direct link to this section

1. Sign in to the Webroot admin console.

2. From the navigation bar, select Sites, and then do the following for each site that you want to monitor:

   

   1. Select the Key beside the name of the site.

   2. Copy the Keycode value to provide to Arctic Wolf later.

Step 4: Retrieve the Webroot GSM keycode Direct link to this section

The GSM keycode is also known as the Parent keycode.

1. Sign in to the Webroot admin console.

2. From the navigation bar, select Settings, and then select Account Information.

3. Copy the Parent Keycode to provide to Arctic Wolf later.

Step 5: Create a new administrator for the Arctic Wolf Sensor Direct link to this section

Arctic Wolf does not require the credentials of a GSM Super Administrator to obtain security information from the Webroot API. Instead, you must create a GSM Limited Administrator account with View Only site permissions for the site that you want Arctic Wolf to monitor.

1. Sign in to the Webroot admin console.

2. From the navigation bar, select Admins and then select Add Admin to open the Create Admin page.

3. In the Details section, enter the appropriate details for each field.

4. Set the Account Type to GSM Limited Administrator.

   Note: Do not create a Site Administrator Only account, as this account does not have GSM console access, which the Arctic Wolf Sensor requires.

5. In the Site Permissions section, select View Only for the new account.

6. Save the username and password of this account to provide to Arctic Wolf later.

   Note: Webroot imposes a maximum length of 30 characters on all passwords, although the GSM console does not consistently enforce this.

7. Select Add to create the new administrator account. The Webroot system sends a verification email to the address provided during the setup process. You must verify the email address for the account before it can be used.

Step 6: Provide credentials to Arctic Wolf Direct link to this section

Complete the following steps for each site that you want Arctic Wolf to monitor.

1. Sign in to the Arctic Wolf Portal.

2. Select Connected Accounts in the banner menu to open the Connected Accounts page.

   

3. Select +Add Account to open the Add Account form.

4. Select Cloud Detection and Response as the Account Type.

5. Select Webroot from the list of cloud services and fill in the form:

   1. Enter a descriptive name for the credentials.
   2. Enter the username and password of the GSM administrator that you created in Create a new administrator for the Arctic Wolf Sensor
   3. Enter the Client ID and Client Secret that you retrieved in Create Webroot API client credentials
   4. Enter the GSM Keycode and Site Keycode that you retrieved in Retrieve the Webroot GSM keycode and Retrieve the Webroot site keycode, respectively.

6. Select Submit to CST.

7. When prompted with the confirmation message, review your submission, and then select Done. You are returned to the Connected Accounts page.

8. Verify that the newly-submitted credential entry appears in the cloud services list with the status Connection Pending.

After your Concierge Security® Team provisions security monitoring for your account, the status of your credentials changes to Connected.