Skip to content

Barracuda WAF

Barracuda WAF


Barracuda Web Application Firewall protects applications, APIs, and mobile app backends against a variety of attacks including the OWASP Top 10, zero-day threats, data leakage, and application-layer denial of service (DoS) attacks. By combining signature-based policies and positive security with robust anomaly-detection capabilities, Barracuda Web Application Firewall can defeat today’s most sophisticated attacks targeting your web applications.

Product Details

Vendor URL: Barracuda WAF

Product Type: Web Access Firewall

Product Tier: Tier II

Integration Method: Custom

Integration URL: N/A

Log Guide: N/A

Parser Details

Log Format: CEF

Expected Normalization Rate: 95%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
"Barracuda" metadata.vendor_name
"WAF" metadata.product_name
dvc observer.ip
dhost target.hostname
dpt target.port
dst target.ip
destinationServiceName target.namespace
src principal.ip
spt principal.port
requestMethod network.http.method
outcome network.http.response_code

Product Event Types

Event UDM Event Classification

Log Sample

1550 <140>1 2022-01-20T00:13:00.845000Z Barracuda - - - - CEF:0|BarracudaNetworks|WAAS|BNWAS-1.0|WAF|WAF|4| cat=TR dvc= duser="-" in=2729 out=1030 suser="-" src= spt=52758; TS01f957cc=013b14e44df483a455159eca6695c9a09a0b11a010ba971f4a8a043d5471b5d5e188384f99d2fbd60f864e88102e4e8a3fa987518d84d62d28c288ec66fefdad0a14ac0051fc79ada1ffe9e68f821b941a945e12badd48caf77 outcome=200 suid="-" requestMethod=POST app=TLSv1.2 msg="-" 11:17:12 AM dst= dpt=443 rt=1642637580845 request=/NewYorkNetworkManagement/ClientBin/Ctc-Core-Notifications-Transport-NotificationServerService.svc/binary/GetNotifications requestClientApplication="Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko" dvchost= cs1Label=ClientType cs1=%ct cs2Label=Protected cs2=PROTECTED cs3Label=ProxyIP cs3= cs4Label=ProfileMatched cs4=DEFAULT cs6Label=WFMatched cs6=VALID cn1Label=ServicePort cn1=9175 cn2Label=CacheHit cn2=0 cn3Label=ProxyPort cn3=43804 flexNumber1Label=ServerTime(ms) flexNumber1=44 flexNumber2Label=TimeTaken(ms) flexNumber2=45 flexString1Label=ProtocolVersion flexString1=HTTP/1.1 BarracudaWafCustomHeader1="-" BarracudaWafCustomHeader2="-" BarracudaWafCustomHeader3="-" BarracudaWafResponseType=SERVER BarracudaWafSessionID="-" destinationServiceName=namespace

Sample Parsing

metadata.event_timestamp = "2022-01-20T00:15:15.177416Z"
metadata.event_type = "NETWORK_CONNECTION"
metadata.vendor_name = "Barracuda"
metadata.product_name = "WAF"
metadata.ingested_timestamp = "2022-01-20T00:15:15.177416Z"
principal.ip = ""
principal.port = 52758
principal.asset.ip = ""
target.hostname = ""
target.ip = ""
target.port = 443
target.namespace = "namespace"
target.asset.ip = ""
observer.ip = ""
network.http.method = "POST"
network.http.response_code = 200


Coming Soon