Barracuda Email Security Gateway

Table of Contents

• Overview
• Prerequisites
• Configuring Barracuda to Forward Logs to CCE
  • Access Syslog Settings
  • Configure Syslog Forwarding
  • Allow Firewall Communication
  • Test Syslog Connectivity
• Verification (MSSP Only)
  • On ADR CCE (CLI)
  • On ADR UI

Overview

This document provides instructions to integrate Barracuda Email Security Gateway (ESG) with ADR SIEM (aiSIEM/aiXDR) using Syslog. By forwarding message log data from Barracuda ESG to ADR via the CCE (Collection and Control Engine), SOC teams gain comprehensive visibility, proactive threat detection, and advanced troubleshooting capabilities. This integration enables centralized tracking, correlation, and analysis of Barracuda logs within ADR SIEM. 

Prerequisites

• A running ADR CCE (Collection and Control Engine).
• Syslog UDP port 514 must be allowed in the firewall between Barracuda ESG and ADR CCE.

Configuring Barracuda to Forward Logs to CCE

Access Syslog Settings

1. Log in to the Barracuda ESG Web UI.
2. Navigate to: Advanced → Advanced Networking.

Configure Syslog Forwarding

In the Syslog Configuration section:

• Mail Syslog: Enter the CCE IP address.
• Web Interface Syslog: Enter the CCE IP address.
• Set the port to 514 and the protocol to UDP.

Click Save to apply changes.

Allow Firewall Communication

• Open any required firewall ports for communication between the Barracuda ESG and ADR CCE server.
• Refer to Barracuda Email Security Service IP Ranges for the correct source IPs if filtering.

Test Syslog Connectivity

1. Click 'Test' to verify that Barracuda ESG can connect to ADR CCE.
2. If successful, the logs will be transferred immediately. If the test fails, check the IP address/hostname and port, correct as needed, and re-test.
3. To remove a Syslog server, click Delete.

Verification (MSSP Only)

On ADR CCE (CLI)

1. Open an SSH session (using tools like PuTTY) to the CCE server.
2. Run the following command to verify log flow:

   sudo tcpdump -i any port 514 and host <Barracuda_ESG_IP> -AAA

   Replace <Barracuda_ESG_IP> with the Barracuda device's IP address.

On ADR UI

1. Log in to the ADR SIEM UI.
2. Navigate to System Logs and Flows > Collection Status.
3. Confirm Barracuda ESG appears listed under Source Device IP, indicating successful integration.