Skip to main content

​
Purpose

The SonicWall integration enables AirMDR to connect with a SonicWall firewall and retrieve security, network, and firewall-related information for investigation, enrichment, and automated response workflows. This guide explains how to collect the following values from the SonicWall UI:
Use a dedicated read-only or least-privilege administrator account wherever possible.

​
Supported Versions

SonicWall confirms that SonicOS firewalls can be managed through the local web-based management interface by accessing the LAN or WAN IP address and signing in with an administrator account.

​
Authentication

AirMDR uses SonicWall firewall credentials to authenticate with the SonicWall firewall.

​
Required Credentials

​
Role-Based Access Considerations

Recommended user role:
Do not use a personal admin account for integrations. Create a dedicated SonicWall user account for AirMDR

​
Pre-requisites

Users must have Administrator access to the SonicWall management UI with sufficient privileges to create or manage users and verify firewall settings.
The SonicWall management interface must be accessible from the AirMDR Remote Agent over HTTPS (default port 443).
AirMDR Remote Agent and Network Connectivity installed and active (if required by deployment model).

​
Setup Steps

1

Identify the SonicWall Firewall IP

  1. Log in to the SonicWall firewall UI using an administrator account.
  2. Navigate to Network → System → Interfaces.
  3. In the Interface Settings table, locate the interface used for management access. Common examples:
  4. Copy the IP address shown for the selected interface.
  5. Use this value as the Firewall IP in AirMDR.
    SonicWall’s interface table lists configured interfaces and their zones, including LAN, WAN, WLAN, DMZ, and MGMT where applicable.
    Prefer the internal LAN or dedicated MGMT IP. Avoid exposing firewall management over the public WAN unless required and secured.
2

Verify HTTPS Management Access

  1. Navigate to Device → Settings → Administration.
  2. Open the Management section.
  3. Confirm that HTTPS management is enabled.
  4. Confirm the HTTPS port.
    Default: 443
    Test browser access: https://<firewall-ip>
    SonicWall recommends using HTTPS to log in to the SonicOS management interface, while HTTP management is disabled by default.
    Avoid using HTTP for firewall administration because credentials may be exposed in transit.
3

Create a Dedicated SonicWall User

  1. Log in to SonicWall UI.
  2. Navigate to Device → Users → Local Users & Groups.
  3. Click Add User.
  4. In the Settings tab, enter:
  5. Save the user.
    SonicWall documentation states that local users are managed from Device → Users → Local Users & Groups.
4

Assign User to the Required Group

  1. In the same user configuration window, open the Groups tab.
  2. Add the user to the required administrator group. Recommended options:
  3. Click Save or Accept.
    SonicWall allows local users to be assigned to groups from the Groups tab under local user settings.
    For AirMDR monitoring-only use cases, assign the minimum permissions required.

​
Integration Credential Requirements

Use the following placeholder values while configuring the SonicWall integration in AirMDR.

​
SonicWall Credential Reference Table

​
Validate Connectivity

Use the following sample token request only for validation from an approved secure environment:
Parameter Details:
“status”: “success”: true , “firmware_version”: “SonicOS 7.0.1”, “model”: “NSa 2700”, “serial_number”: “123456789”, “hostname”: “sonicwall-fw”
“status”:“success”: false,“message”: “Authentication failed”
curl: (7) Failed to connect to 192.168.1.1 port 443: Connection refused
Common Causes

​
Configure Sonicwall in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
  3. Use the search option, enter the keyword “SonicWall”, select the Connections tab, and click + Create button.
  4. Enter an unique name to the Instance (e.g., your org name-SonicWall) to easily identify the user connection by AirMDR.
  5. Enter the application credentials like Firewall IP, Username and Password in the Authentication Details field params, and click Save.

​
Skills provided by this Integration

To view the details of Input Parameters and Output for the respective skills
  • Go to AirMDR → SonicWall Integration page.
  • Select the Skills tab and click on the required listed skills.

​
Additional Information

​
SonicWall UI Logs

Navigate to 
Monitor → Logs → System Logs
or
Investigate → Logs
depending on SonicOS version.

​
What to Monitor

​
Sample Log Entry

User login successful: user=airmdr-readonly source=<remote-agent-ip>User login failed: user=airmdr-readonly reason=Invalid credentials
  • 📧 Contact AirMDR Support through your designated support channel.
  • 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
  • 🔄 Reconnect in AirMDR when secrets are changed.
  • Access Review Review the SonicWall integration user periodically.

​
Data Exchanged

​
Ports and Endpoints

Allow connectivity from the AirMDR remote agent to the SonicWall management IP on the required port.