{
    "id": "Barracuda",
    "title": "[Deprecated] Barracuda Web Application Firewall via Legacy Agent",
    "publisher": "Barracuda",
    "descriptionMarkdown": "The Barracuda Web Application Firewall (WAF) connector allows you to easily connect your Barracuda logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.\n\n[For more information >​](https://aka.ms/CEF-Barracuda)",
    "logo": "barracuda_logo_light.png",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Barracuda CEF",
            "baseQuery": "\nCommonSecurityLog​ \n| where DeviceVendor == \"Barracuda\"\n"
        },
        {
            "metricName": "Total data received",
            "legend": "Barracuda CL",
            "baseQuery": "barracuda_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "\nCommonSecurityLog​ \n| where DeviceVendor == \"Barracuda\"\n\n            | sort by TimeGenerated"
        },
        {
            "description": "Summarize by protocol and destination IP",
            "query": "\nCommonSecurityLog​ \n| where DeviceVendor == \"Barracuda\"\n\n            | summarize count() by ApplicationProtocol, DestinationIP​"
        },
        {
            "description": "Barracuda audit logs events",
            "query": "barracuda_CL\n            | where Vendor_s == \"Barracuda\" and Product_s == \"WAF\"\n| where LogType_s == \"AUDIT\"\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "\nCommonSecurityLog​ \n| where DeviceVendor == \"Barracuda\"\n\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "barracuda_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "CommonSecurityLog (Barracuda)",
            "lastDataReceivedQuery": "\nCommonSecurityLog​ \n| where DeviceVendor == \"Barracuda\"\n\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "Barracuda_CL",
            "lastDataReceivedQuery": "barracuda_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure and connect Barracuda WAF",
            "description": "The Barracuda Web Application Firewall can integrate with and export logs directly to Microsoft Sentinel via Azure OMS Server.​\n\n1.  Go to [Barracuda WAF configuration](https://aka.ms/asi-barracuda-connector), and follow the instructions, using the parameters below to set up the connection:.\n\n2.  Web Firewall logs facility: Go to the advanced settings (link below) for your workspace and on the **Data > Syslog** tabs, make sure that the facility exists.​\n\n> Notice that the data from all regions will be stored in the selected workspace",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        }
    ],
    "metadata": {
        "id": "5fcd2f13-eaf9-46a7-8c6e-aa5d86b8f1f7",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Barracuda Networks"
        },
        "support": {
            "name": "Barracuda Networks",
            "link": "https://www.barracuda.com/support",
            "tier": "developer"
        }
    }
}