Integrating with Barracuda Web Application Firewall

Overview

Configure Barracuda Web Application Firewall (WAF) to send event logs directly to Blumira. This integration will add several new data sources, which you can use for reporting and compliance. After completing the procedure below, the following Barracuda WAF logs will be sent to Blumira:

• Access logs
• Audit logs
• System logs
• Traffic logs

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Gather the IP address of your Blumira sensor to use when configuring the external service.

To find and copy the IP address of the sensor, do the following:

1. In Blumira, navigate to Settings > Sensors.
2. Click the sensor row to open the details page.
3. In the Overview section, next to Host Details, copy the IP address.

Configuring Barracuda WAF log export

To configure the Barracuda WAF, do the following:

1. Log in to your Barracuda WAF as an administrator.
2. Navigate to Advanced > Export Logs.
3. Click Add Log Server. 
4. In the Add Export Log Server window, do the following:
   1. In the Name box, type a name for this integration.
   2. In the Log Server Type box, select Syslog NG.
   3. In the IP Address or Hostname box, type your Blumira sensor's IP address.
   4. In the Port box, type 514.
   5. In the Connection Type options, select UDP.
   6. In the Validate Server Certificate options, select No.
   7. In the Client Certificate options, select No.
   8. In the Log Timestamp and Hostname options, select Yes.
   9. Click Add.
5. Leave all default settings in place within the Logs Format section.