Integrate Barracuda CloudGen

You can integrate Barracuda CloudGen with Sophos Central so that it sends alerts to Sophos.

This integration uses a log collector hosted on a virtual machine (VM). Together they're called an integration appliance. The appliance receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in an integration are as follows:

• Add an integration for this product. In this step, you create an image of the appliance.
• Download and deploy the image on a VM. This becomes your appliance.
• Configure Barracuda CloudGen to send data to the appliance.

Requirements

Appliances have system and network access requirements. To check that you meet them, see Appliance requirements.

Add an integration

To add the integration, do as follows:

1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

2. Click Barracuda CloudGen.

   The Barracuda CloudGen page opens. You can add integrations here and see a list of any you've already added.

3. In Data Ingest (Security Alerts), click Add Configuration.

   Note

   If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See My domains and IPs.

   Integration setup steps appears.

Configure the appliance

In Integration setup steps, you can configure a new appliance or use an existing one.

We assume here that you configure a new appliance. To do this, create an image as follows:

1. Enter an integration name and description.
2. Click Create new appliance.
3. Enter a name and description for the appliance.
4. Select the virtual platform. Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later.

5. Specify the IP settings for the Internet-facing network ports. This sets up the management interface for the appliance.

   • Select DHCP to assign the IP address automatically.

     Note

     If you select DHCP, you must reserve the IP address.

   • Select Manual to specify network settings.

6. Select the Syslog IP version and enter the Syslog IP address.

   You'll need this syslog IP address later, when you configure Barracuda CloudGen to send data to your appliance.

7. In Protocol, TCP is pre-selected. You can't change it.

   When you configure Barracuda CloudGen to send data to your appliance, you must make sure it uses the same protocol.

8. Click Save.

   We create the integration and it appears in your list.

   In the integration details, you can see the port number for the appliance. You'll need this later when you configure Barracuda CloudGen to send data to it.

   It might take a few minutes for the appliance image to be ready.

Deploy the appliance

Use the image to deploy the appliance, as follows:

1. In the list of integrations, in Actions, click the download action for your platform, for example Download OVA for ESXi.
2. When the image download finishes, deploy it on your VM. See Deploy an appliance.

Configure Barracuda CloudGen

Now configure Barracuda CloudGen to send alerts to us, using syslog forwarding.

Enable syslog streaming

Enable syslog streaming on the Barracuda CloudGen Firewall as follows:

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.
2. Click Lock.
3. Set Enable Syslog Streaming to yes.
4. Click Send Changes and Activate.

Enable detailed firewall reporting

1. Go to Configuration Tree > Infrastructure Services > General Firewall Configuration.
2. Click Lock.
3. In the left menu, select Audit and Reporting.
4. Under Log Policy, set the Activity Log Mode to Log-Pipe-Separated-Key-Value-List.
5. Click Send Changes and Activate.

Example output with Log-Pipe-Separated-Key-Value-List:

2024 05 07 10:02:51 +00:00 Info     Allow: type=LOUT|proto=TCP|srcIF=dhcp|srcIP=10.0.0.4|srcPort=47542|srcMAC=00:0d:3a:46:14:a3|dstIP=168.63.129.16|dstPort=32526|dstService=|dstIF=|rule=PASSALL|info=0|srcNAT=10.0.0.4|dstNAT=168.63.129.16|duration=0|count=1|receivedBytes=0|sentBytes=0|receivedPackets=0|sentPackets=0|user=|protocol=|application=|target=|content=|urlcat=

Configure logdata filters

Specify the log file types to stream.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming .
2. In the left menu, select Logdata Filters.
3. Click Lock.

4. In the Filters table, click "+" to add a new filter.

   The Filters window opens.

5. Enter a Name, for example "Sophos MDR integration".

6. Click OK.

7. In the Data Selection table, add the Top Level Logdata log files to be streamed. You can select:

   • Fatal_log
   • Panic Log
   • Firewall_Audit_Log

   For Firewall_Audit_Log, the firewall audit log must be enabled and configured, and Audit Delivery must be set to Syslog Proxy. See How to Enable the Firewall Audit Log Service.

Configure Sophos as the logstream destination

Configure the firewall to send the syslog stream to Sophos Central.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.
2. In the left menu, select Logstream Destinations.
3. Click Lock.

4. In the Destinations table, click "+" to add a new filter.

   The Destinations page opens.

5. Enter a Name and click OK.

6. In Logstream Destination, select the name you entered when you configured the logdata filters ("Sophos MDR integration" in our example).
7. In Destination IP Address and Destination Port enter the IP address and port you configured in Sophos Central earlier.
8. Click Send Changes and Activate.

Configure the logdata stream

Combine the logdata filters and logstream destination to set up a logdata stream.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.
2. In the left menu, select Logdata Streams.
3. Click Lock.

4. In the Streams table, click "+" to add a new syslog stream.

   The Streams window opens.

5. Enter a Name. Use the same name used in previous sections ("Sophos MDR integration" in our example).

6. Click OK.
7. Set Active Stream to yes.
8. In the Log Destinations table, click "+" and select the logstream destination you configured earlier.
9. In the Log Filters table, click "+" and select the logdata filter you configured earlier.
10. Click OK.
11. Click Send Changes and Activate.

All logs covered by the logdata filter are now streamed to Sophos.