Ingest Logs

Prerequisites

• Logpoint: v6.7.0 or later

• Logpoint: v7.4.0 or later for log source template

• Barracuda Access: Syslog forwarding configured on Barracuda devices to send logs to Logpoint

Install Barracuda

1. Download the .pak file from the Marketplace.

2. Go to Settings >> System Settings from the navigation bar.

3. Click Applications.

4. Click Import.

5. Browse to the downloaded .pak file.

6. Click Upload.

After installation, verify if the integration appears under Settings >> System Settings >> Plugins.

---

Configure Barracuda

Configure Barracuda using two methods:

1. Log Source Template (recommended), which provides a centralized interface for all integrations and minimizes setup requirements

2. Devices

Method 1: Configure via Log Source Template

For Logpoint v7.4.0 and above:

You must create a log source using the log source template to receive the normalized Barracuda logs.

1. Go to Settings >> Log Sources from the navigation bar.

2. Click Browse Log Source Templates and select Barracuda.

Source

Configure the log source settings.

1. Click Source.

2. Enter the Log Source's Name.

3. Select the Device Addresses.

4. Select the Device Groups.

5. Select a Time Zone. The device's timezone must match its log source.

6. Configure the Risk Values for Confidentiality, Integrity, and Availability used to calculate the risk levels of the alerts generated from the device.

Connector

Configure the connection to Barracuda.

1. Click Connector.

2. Select Syslog Parser as Parser.

3. Select the Charset.

4. In Proxy Server, select None (or configure proxy settings if required).

Routing

Set up log storage and routing:

Create Repository

1. Click Routing and + Create Repo.

2. Enter a Repo name.

3. In Path, specify the location to store incoming logs.

4. In Retention (Days), set how long logs are kept before automatic deletion.

5. In Availability, select the Remote logpoint and Retention (Days).

6. Click Create Repo.

7. Select the created repo in Repo.

Create Routing Criteria

1. Click + Add row.

2. Enter a Key and Value for log filtering.

3. Select log handling options:

   • Store raw message: Store both incoming and normalized logs.

   • Discard raw message: Keep only normalized logs.

   • Discard entire event: Discard both incoming and normalized logs.

4. Select the target Repository.

Normalization

Set up log normalization:

1. Click Normalization.

2. Either:

   1. Select a previously created normalization policy from the dropdown, or

   2. Select BarracudaCompiledNormalizer from the following list based on your Barracuda products:

      1. LP_Barracuda Email Security Gateway

      2. LP_Barracuda NG Firewall

      3. LP_Barracuda Web Application Firewall

      4. LP_Barracuda WAF CEF

      5. LP_Barracuda Firewall

      6. LP_Barracuda Web Filter

      7. LP_Barracuda Load Balancer

      8. LP_Barracuda ADC 540Vx Loadbalancer

      9. LP_Barracuda Cloud Email Filter

3. Click the swap icon.

Enrichment

Configure log enrichment

1. Click Enrichment.

2. Select an Enrichment Policy.

Click Create Log Source to save above configurations.

---

Method 2: Configure via Devices

Configuring a Repo

1. Go to Settings >> Configuration from the navigation bar and click Repos.

2. Click Add.

3. Enter a Repo Name.

4. Select a Repo Path to store incoming logs.

5. Set a Retention Day to keep logs in a repository before they are automatically deleted. You can add and remove multiple Repo Paths and Retention Days.

6. Select a Remote LogPoint and set an Available for (day).

7. Click Submit.

Adding a Normalization Policy

Normalization policies normalize and standardize logs for efficient storage, analysis, and retrieval.

1. Go to Settings >> Configuration in the navigation bar, then click Normalization Policies.

2. Click Add.

3. Enter a Policy Name.

4. In Compiled Normalizer, select BarracudaCompiledNormalizer.

5. In Normalization Packages, select the required normalization package(s) based on your Barracuda products:

   • LP_Barracuda Email Security Gateway

   • LP_Barracuda NG Firewall

   • LP_Barracuda Web Application Firewall

   • LP_Barracuda WAF CEF

   • LP_Barracuda Firewall

   • LP_Barracuda Web Filter

   • LP_Barracuda Load Balancer

   • LP_Barracuda ADC 540Vx Loadbalancer

   • LP_Barracuda Cloud Email Filter

6. Click Submit.

Configuring a Processing Policy

Processing policy dictates how Barracuda logs are handled, processed, and stored to enhance their usability and accessibility for monitoring, reporting, and alerting purposes.

1. Go to Settings >> Configuration from the navigation bar and click Processing Policies.

2. Click Add.

3. Enter a Policy Name.

4. Select the previously created normalization policy.

5. Select the Enrichment Policy.

6. Select the Routing Policy.

Adding Barracuda as a Device

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click Add.

3. Enter a device Name.

4. Enter the Barracuda server IP address(es).

5. Select the Device Groups.

6. Select an appropriate Log Collection Policy for the logs.

7. Select a collector or a forwarder from the Distributed Collector drop-down. It is optional to select the Device Groups, the Log Collection Policy, and the Distributed Collector.

8. Select a Time Zone. The timezone of the device must bethe same as its log source.

9. Configure the Risk Values for Confidentiality, Integrity, and Availability used to calculate the risk levels of the alerts generated from the device.

10. Click Submit.

Configuring the Syslog Collector

1. Go to Settings >> Configuration in the navigation bar, then click Devices.

2. Click the Add collectors/fetchers icon under Actions of the previously added device.

3. Click Syslog Collector.

4. Select Syslog Parser as Parser.

5. Select the previously created Processing Policy.

6. Select the Charset.

7. In Proxy Server, select None (or configure proxy settings if required).

8. Click Submit.

---

Verify Ingestion

Check Log Ingestion

Use the following query to verify Barracuda logs are being ingested:

col_type = "barracuda"

Or search by specific Barracuda product:

norm_id = "Barracuda*"

Verify Data Flow

1. Check Syslog Collector Status: Ensure the Barracuda collector is running without errors.

2. Monitor Log Volume: Verify expected log volumes are being processed.

3. Validate Normalization: Confirm logs are correctly parsed and normalized using the BarracudaCompiledNormalizer.

4. Test Dashboards: Access Barracuda dashboards to verify data visualization.