Configuring Barracuda Web Application Firewall to send syslog events to QRadar

Configure your Barracuda Web Application Firewall appliance to send syslog events to IBM QRadar.

Before you begin

Verify that firewalls between the Barracuda appliance and QRadar allow UDP traffic on port 514.

Procedure

  1. Log in to the Barracuda Web Application Firewall web interface.
  2. Click the Advanced tab.
  3. From the Advanced menu, select Export Logs.
  4. Click Add Syslog Server.
  5. Configure the parameters:
    Option Description
    Name The name of the QRadar Console or Event Collector
    Syslog Server The IP address of your QRadar Console or Event Collector.
    Port

    The port that is associated with the IP address of your QRadar Console or Event Collector.

    If syslog messages are sent by UDP, use the default port, 514.
    Connection Type The connection type that transmits the logs from the Barracuda Web Application Firewall to the QRadar Console or Event Collector. UDP is the default protocol for syslog communication.
    Validate Server Certificate No
  6. In the Log Formats pane, select a format from the list box for each log type.
    • If you are using newer versions of Barracuda Web Application Firewall, select LEEF 1.0 (QRadar).
    • If you are using older versions of Barracuda Web Application Firewall, select Custom Format.
  7. Click Save Changes.