Configure Webroot for Arctic Wolf monitoring

You can configure Webroot® to send the necessary logs to Arctic Wolf® for security monitoring.

Requirements

• A Webroot GSM console account with Super Administrator permissions

Steps

1. Convert your GSM console to an MSP console.
2. Create Webroot API client credentials.
3. Retrieve the Webroot site keycode.
4. Retrieve the Webroot GSM keycode.
5. Create a new administrator for the Arctic Wolf Sensor.
6. Provide credentials to Arctic Wolf.

Step 1: Convert your GSM console to an MSP console

The Managed Service Provider (MSP) console is required to access the Webroot API. Arctic Wolf uses this API to retrieve security information.

1. Do one of these actions:

   • If you are using the MSP console, complete Create Webroot API client credentials.
   • If you are not using the MSP console, sign in to the Webroot admin console with GSM Super Administrator permissions, and then go to the next step.

2. In the navigation menu, click Settings, and then:

   • If Advanced Settings appears — click Advanced Settings.
   • If API Access appears — You are already running the MSP console. Complete Create Webroot API client credentials.

3. In the Advanced Settings section, click Convert.

4. In the dialog, select the checkbox, and then click Convert Console.

5. For the MSP Console tutorial, do one of these actions:

   • Complete the tutorial — Click Next on all pages that appear.
   • Skip the tutorial — Click Skip.

Step 2: Create Webroot API client credentials

1. Sign in to the Webroot admin console.

2. In the navigation menu, click Settings.

3. On the API Access tab, click New.

4. In the Name and Description fields, enter information, and then click Create.

5. Copy the Client ID and Client Secret values, and then save them in a safe, encrypted location. You will provide them to Arctic Wolf later.

   Note: The Client Secret value is only accessible to view in the dialog.

6. Click I have made note of the client secret.

Step 3: Retrieve the Webroot site keycode

1. Sign in to the Webroot admin console.
2. In the navigation menu, click Sites.
3. For each site that you want Arctic Wolf to monitor, complete these steps:

   1. Click the key icon beside the name of the site.

      

   2. Copy the Keycode value, and then save it in a safe, encrypted location. You will provide it to Arctic Wolf later.

Step 4: Retrieve the Webroot GSM keycode

1. Sign in to the Webroot admin console.
2. In the navigation menu, click Settings > Account Information.
3. Copy the Parent Keycode, and then save it in a safe, encrypted location. You will provide it to Arctic Wolf later.

Step 5: Create a new administrator for the Arctic Wolf Sensor

1. Sign in to the Webroot admin console.

2. In the navigation menu, click Admins > Add Admin.

3. On the Create Admin page, on the Details tab, configure these settings:

   • Email Address — Enter an email address for your GGSM admin account.

   • First Name — Enter a first name for your GGSM admin account. For example, Tester.

   • Last Name — Enter a last name for your GGSM admin account. For example, Admin.

   • Phone — Enter a phone number for your GGSM admin account.

   • Time Zone — Select a time zone for your GGSM admin account.

   • Account Type — Select GSM Limited Administrator.

     Note: Do not select Site Administrator Only. This account type does not have GSM console access, which the Arctic Wolf Sensor requires.

4. On the Site Permissions tab, select View Only.

5. Save the username and password of this account in a safe, encrypted location. You will provide it to Arctic Wolf later.

   Note: Webroot imposes a maximum length of 30 characters on all passwords.

6. Click Add.

   The Webroot system sends a verification email to the address provided during the setup process.

7. Verify the email address for the account using the verification email from Webroot.

Step 6: Provide credentials to Arctic Wolf

1. Sign in to the Arctic Wolf Unified Portal.

2. Click Telemetry Management > Connected Accounts.

3. Click Add Account +.

4. On the Add Account page, in the Account Type list, select Cloud Detection and Response.

5. In the cloud services list, click Webroot.

6. On the Add Account page, configure these settings:

   • Account Name — Enter a unique and descriptive name for the account.

   • GGSM admin username — Enter the username for the GSM administrator account created in Create a new administrator for the Arctic Wolf Sensor.

   • GSM admin password — Enter the password of the GSM administrator account created in Create a new administrator for the Arctic Wolf Sensor.

   • Client ID — Enter the client ID from Create Webroot API client credentials.

   • Client secret — Enter the client secret from Create Webroot API client credentials.

   • GSM keycode — Enter the GSM keycode from Retrieve the Webroot GSM keycode.

   • Site keycode — Enter the site keycode from Retrieve the Webroot site keycode.

     Note: The Site Keycode value is unique for each site.

   • Credential Expiry — (Optional) Enter the credential expiration date, if applicable.

7. Click Test and submit credentials.