Ask the Community
Groups
Barracuda - Connect IT Community | Kaseya
<main> <article class="userContent"> <h2 data-id="review-configuration-options-for-barracuda-firewalls-in-rocketcyber">Review configuration options for Barracuda firewalls in RocketCyber</h2> <h3 data-id="configuration-options">Configuration Options</h3> <table border="1" cellpadding="4"><tbody><tr><td> <p data-key="74">User quarantined alert</p> </td> <td> <p>This alerts the user when a file is quarantined by the firewall</p> </td> </tr><tr><td> <p data-key="81">ATP alert (malicious)</p> </td> <td>Barracuda's Advanced Threat Prevention (ATP) system classifies this traffic as malicious</td> </tr><tr><td> <p data-key="90">DNS sinkhole detection</p> </td> <td>A DNS sinkhole is a server that gives incorrect name resolution. For example, it could resolve <em>www.google.com</em> to a server owned or controlled by the malicious actor. </td> </tr><tr><td> <p data-key="97">Antivirus</p> </td> <td> <p data-key="102">Checks files going to your computer for known viruses</p> </td> </tr><tr><td> <p data-key="106">ATP (file block)</p> </td> <td>Runs machine learning predictors on files hitting the firewall to predict malicious files</td> </tr></tbody></table><h3 data-id="log-format">Log Format</h3> <p>The expected format for Barracuda logs is <strong>pipe-separated</strong>. For example</p> <pre class="code codeBlock" spellcheck="false" tabindex="0"><14>May 8 15:04:19 F77 F77/box_Firewall_Activity: Info F77 ARP: <cumulative>|ALLIP(0)|p2|192.168.77.177|0|00:00:00:00:00:00|192.168.70.77|0||||3030|0.0.0.0|0.0.0.0|0|5|0|0|0|0||||||</pre> </article> </main>