Explore and Analyze Barracuda Events
After Logpoint ingests Barracuda logs:
Use Search to access and examine events.
View events in real time through Dashboards.
Use Search Templates for pre-built analysis scenarios.
Search
Use the following queries to explore common Barracuda events:
All Barracuda logs
col_type = "barracuda"
All normalized Barracuda events
norm_id = "Barracuda*"
Firewall allow events
norm_id = "Barracuda*" label = "Allow"
Firewall deny/block events
norm_id = "Barracuda*" label IN ["Deny", "Block", "Drop"]
Attack detection events
norm_id = "Barracuda*" label = "Detect"
Web application firewall attacks
norm_id = "BarracudaWAF" label = "Attack"
Email virus detections
norm_id = "Barracuda*" label = "Virus"
Spam detections
norm_id = "Barracuda*" label = "Spam"
Blocked attachments
norm_id = "Barracuda*" label = "Banned" label = "Attachment"
IPS alerts
norm_id = "Barracuda*" label = "IPS"
Web filter blocked content
norm_id = "BarracudaWebFilter" label = "Block"
Search Templates
LP_BarracudaWAF Search Template
The LP_BarracudaWAF search template provides pre-configured analysis scenarios for common Barracuda Web Application Firewall monitoring and investigation use cases. These templates help you quickly analyze attack patterns, traffic trends, and security events and identify threats and vulnerabilities.
Using LP_BarracudaWAF Search Template
Go to Settings >> Knowledge Base from the navigation bar and click Search Templates.
Select VENDOR SEARCH TEMPLATES from the drop-down and click LP_BarracudaWAF.
In Update Parameters, enter the required parameter(s).
3.1 Select Override widget time range to set a time range.
3.2 Select REPOS.
3.3 Click Update.
After updating, the widgets start populating the results. Logpoint forwards you to Search Template View to access the dashboards of the search template.
Dashboards
LP_Barracuda Web Application Firewall Dashboard
The LP_Barracuda Web Application Firewall dashboard provides real-time insights into web application security across your environment, showing patterns in attack detection, traffic actions, protocol usage, and error responses. It helps you identify attack sources, monitor threat trends, track firewall actions, and investigate injection and DOS attacks.
Dashboard Widgets:
Attack Count
The count of attacks such as DDOS attacks, forceful browsing, protocol violations, limits violation and other to gain unauthorized access to a computer, computing system or computer network with the intent to cause damage.
Attack Timetrend
A time span observation providing a dynamic view of attacks in the hope of forecasting future attacks.
Top 10 Attack Events
The top ten attack events that have or might lead to unauthorized data access, processing, corruption, alteration, transfer or disclosure of data.
Top Distinct Attacks by Source Locations
The sources of top distinct attacks and their destinations based on source country, action and destination address.
Total Attackers
The distinct count of total attackers based on source address.
Top Actions Taken on Traffic
The top actions taken on traffic by a firewall to block attack traffic while allowing valid traffic through the firewall with no impact on the quality of experience of the valid traffic.
Top 10 Errors from Client
The top ten client-side error codes such as Invalid Request (status code 400), Authentication Failed (401), Not Found (status code 404), Method Not Allowed (status code 405) and Invalid Post Data (status code 415) that occurred on a client-server system, such as a web application.
Top 10 Protocols
The top ten protocols applied by a firewall to establish a secure communication between different devices for the exchange of data.
Injection Attack Details
Details of an injection attack such as blind SQL injection or SSI injection. An attacker injects code into a program or query, or injects malware onto a computer to execute remote commands that can read or modify a database, or change data on a web site.
DOS Attack Details
Details of DOS attack such as buffer overflows or flood attacks, where an attacker uses a false IP address to flood the targeted host or network with illegitimate service requests.
Top 10 Users in Attack Events
The top ten remote or local users involved during an attack.
Attack Details
Details of the attack including source address, source country, attack type, destination address, destination country, request method, URL, rule type and actions.
LP_Barracuda SV Firewall Dashboard
The LP_Barracuda SV Firewall dashboard provides real-time insights into email security and spam/virus filtering across your environment, showing patterns in message processing, blocklist management, virus detection, and attachment filtering. It helps you monitor email traffic, identify malicious senders, track message delivery status, and investigate security threats.
Dashboard Widgets:
Top 10 Action
The top ten actions taken to inspect incoming and outgoing traffic using a set of security rules to identify and block threats.
Top 10 Mail Destinations Domain
The top ten destination addresses domains where emails were sent, for a firewall to allow or block the destination IP address.
Top 10 Source Address
The top ten source addresses of a device or user that sent data across the network. It allows an administrator to specify which source addresses are allowed or denied access to the network or choose to block all traffic from a particular source address.
Top 10 Mail Sender
The top ten email senders whose behavior on the server is monitored. Problem senders are blocklisted based on their IP address and domain name.
Top 10 Mail Receiver
The top ten email receivers can help administrators decide what kind of filters to apply to incoming emails in addition to removing spam.
User Login - List
The user logins activity list by login timestamp, username and actions.
Time trend of Action
A dynamic view of actions that can help forecast future threats.
Top 10 Destination Address
The top ten destination addresses of servers where you want to grant access to a service.
Message Category - RECV and SCAN services
The data on RECV services indicating a message was handled by the MTA and processing stopped and SCAN service indicating the message was scanned and processing may have stopped or it may have been sent to outbound processing for delivery.
Message Category - SEND services
The data on SEND services, such as delivered message, rejected message, deferred message and expired message indicating the status of outbound delivery.
Top 15 Event Category by Reason Code
The top fifteen Barracuda event categories by reason code, such as Virus, Banned Attachment or RBL Match to identify an error condition.
Top 10 Hosts in Barracuda Blocklist Category
The top ten hosts linked to junk emails in the block list category.
Top 10 Senders in Barracuda Blocklist Category
The top ten senders in the block list category from which you would not receive emails.
Top 10 Receivers in Barracuda Blocklist Category
The top ten receivers in the block list category who would not receive incoming mails.
Top 10 Hosts in Virus Category
Top ten hosts categorized as Virus of Barracuda RECV and SCAN services.
Top 10 Senders in Virus Category
Top ten senders categorized as Virus of Barracuda RECV and SCAN services.
Top 10 Receivers in Virus Category
Top ten receivers categorized as Virus of Barracuda RECV and SCAN services.
Top 10 Receivers in Banned Attachment Category
The top ten receivers in the Band Attachment category of Barracuda RECV and SCAN services based on filename patterns you specify, common text attachment file types and attachment MIME types.
Top 10 Senders in Banned Attachment Category
Top ten senders in the Band Attachment category of Barracuda RECV and SCAN services.
Top 10 hosts in Banned Attachment Category
Top ten hosts in the Band Attachment category of Barracuda RECV and SCAN services.
Top 10 host in Spam Fingerprint Found Category
The top ten hosts in the Spam Fingerprint Found category of Barracuda RECV and SCAN services through which hackers create a network map that helps them identify vulnerabilities for a successful attack.
Top 10 Sender in Spam Fingerprint Found Category
Top ten senders in the Spam Fingerprint Found category of Barracuda RECV and SCAN services.
Top 10 receiver in Spam Fingerprint Found Category
Top ten receivers in the Spam Fingerprint Found category of Barracuda RECV and SCAN services.
LP_Barracuda Web Filter Dashboard
The LP_Barracuda Web Filter dashboard provides real-time insights into web filtering activity across your environment, showing patterns in URL access, content filtering, and policy enforcement. It helps you monitor web traffic, identify blocked content, track filtering actions, and analyze access patterns by category and content type.
Dashboard Widgets:
Barracuda Web Filter Details - List
A list of Barracuda Web Filters activities based on timestamp, source address, destination address, URL, action, reason, content type (HTML or jpeg), data size, matched part and category.
Top 10 Source Address
The top ten source addresses to prevent malicious traffic.
Top 10 Destination Address
The top ten destination addresses to prevent certain data from flowing into a destination.
Top 10 Action with Reason
The top ten actions performed by Barracuda Web Filter, along with the reasons for the actions taken. For example, a device scanned as a threat is detected.
URL Details - List
A list of the frequently visited URLs based on action, reason, matched part and category.
Top Content Type - List
A list of the top website contents filtered by Barracuda Web Filters.
Top Matched Part - List
A list of the top regular expressions, domain names or keywords that matched to a URL.
Top Matched Category - List
A list of the top built-in or customized web content categories that matched with your regular expressions, domain names or keywords.
Adding Barracuda Dashboards
Navigate to Settings >> Knowledge Base >> Dashboard.
Select VENDOR DASHBOARD from the dropdown.
Click the Use icon under Actions of the required dashboard.
Click Choose Repos.
Select the repository configured for Barracuda logs and click Done.
In Ask Repos, select the dashboard and click Ok.
The dashboard will appear under Dashboards. You can view details about each widget by clicking the Info icon.
Last updated
Was this helpful?