Barracuda CloudGen集成

您可以將 Barracuda CloudGen 與 Sophos Central 整合，以便其將警示傳送到 Sophos 進行分析。

此頁面提供集成的概述。

Barracuda CloudGen概述

Barracuda CloudGen Firewall 為雲端和混合網路提供全面的安全解決方案。該防火牆改善了網站到網站的連線，並可實現不間斷存取雲端中託管的應用程式。Barracuda 憑藉包括進階威脅防護和全域情報網路在內的多層防禦，可確保即時防禦各種網路威脅，例如勒索軟體和零時差攻擊。它可跨實體和雲端環境部署，提供整合的 SD-WAN 功能以實現無縫連線，並提供集中管理工具以簡化部署、提供全面的網路可見性。

Sophos文檔

整合 Barracuda CloudGen

我們攝取的東西

Sophos看到的示例警報：

Login from IP_ADDRESS: Denied: Firewall Rule RULE
rolled out network relevant configuration files
Load Config from FILE
Plug and Play ACPI device, ID (active)
starting vpn client
FW UDP Connection Limit Exceeded
FW Rule Warning
FW Flood Ping Protection Activated

已擷取完整警示

我們建議您配置Barracuda CloudGen防火牆的詳細防火牆報告系統日誌輸出，但這會受到重要過濾，因此它只處理有用的安全警報。

大多數警報都使用正則表達式進行標準化。

篩選

我們目前會過濾最吵雜的警示。其中包括以下內容：

UDP-NEW\\(Normal Operation,0\\)
Session Idle Timeout
\\[Request\\] Allow
\\[Request\\] Remove
\\[Sync\\] Changed: Transport
Session PHS: Authentication request from user
Tunnel has now one working transport
Session -------- Tunnel
Abort TCP transport
Info CHHUNFWHQ-01 Session
: Accounting LOGIN
State: REM\\(Unreachable Timeout,20\\)
read failed\\(IOStreamSock: Receive\\(\\) end of file\\) closing connection
DH attributes found in request, generating new key
\\[Sync\\] Changed: Checking Transports
State: UDP-FAIL\\(Port Unreachable,3\\)
DH key agreement successful
Request Timeout \\(HandshakeRequest ReqState=Init RepState=Init\\) -> terminate session
\\[Sync\\] Local: Update Transport
send fast reply
\\[Sync\\] Session Command
\\[HASYNC\\] update
Transport .* State changed to
Accounting LOGOUT
TCP.*close on command
Rule: Authentication Login
Rule: Authentication Logout
Error.*Request Timeout
Info.*Delete Transport
Info.*\\[HASYNC\\]
Notice.*\\[HASYNC\\]
Warning.*Tunnel Heartbeat failed
Info.*Worker Process.*timeout
Error.*Operation: Poll.*Timeout
Info.*\\(New Request
Info.*\\(Normal Operation

威脅映射示例

我們將fields.message用於存在的威脅映射，或從標準事件類型的信息字段查找代碼。請參閱安全事件。

"alertType": "=> searchRegexList(fields.message, [_.referenceValues.code_translation.regex_alert_type, _.globalReferenceValues.code_translation.regex_alert_type]) ? searchRegexList(fields.message, [_.referenceValues.code_translation.regex_alert_type, _.globalReferenceValues.code_translation.regex_alert_type]) : fields.message"

樣本

{"alertType": "Number of child processes automatically set to N based on number of CPU cores and size of RAM", "threatId": "T1057", "threatName": "Process Discovery"}
{"alertType": "found no explicit phase1 aggressive configuration in IP_ADDRESS for client", "threatId": "T1573", "threatName": "Encrypted Channel"}