How to Configure Barracuda XDR in SecureEdge

The Barracuda SecureEdge Manager allows administrators to stream logs to the Extended Detection and Response (XDR) services. XDR is a security-threat detection and incident response tool that integrates multiple security products (such as Cloud Security, Email Security, Endpoint Security, Network Security, and Server Security) into a security operation system in order to detect threats and provide an incident response to malicious events. Barracuda XDR streaming is disabled by default, but you can enable or disable it for an entire workspace. You can integrate to the Barracuda XDR service via SecureEdge Manager and stream logs for security threats. You can stream the following logs: Firewall, VPN, Connectivity, Threat, and SD-WAN (connectivity). For instructions on how to set up the Barracuda XDR, see Integrating Barracuda SecureEdge Firewall. For more information on the XDR service, see Barracuda XDR. 

Configure Barracuda XDR

1. Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.

2. In the left menu, click the Tenants/Workspaces icon and select the workspace you want to configure Barracuda XDR for.

3. Go to Integration > Barracuda XDR.
   

4. The Barracuda XDR page opens. Specify values for the following:

   • Enable Streaming – Click to enable/disable. By default, XDR streaming is disabled.
     When Streaming is enabled, specify the following:
     • Sites – Select the site from the drop-down list, or type to search. You can select either all sites or a specific site.
     • Edge Service – Select the edge service from the drop-down list, or type to search. You can select either all edge services or a specific edge service.
     • Hostname – Enter secure-edge.ingest.skoutsecure.com

     • Port – Enter 5044
       

5. Click Save.

After the configuration is complete, you can see that the selected sites or edge services in your workspace start streaming their logs to Barracuda XDR services in order to monitor and analyze for security threats. 

Edit the Barracuda XDR Configuration 

1. Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.

2. In the left menu, click the Tenants/Workspaces icon and select the workspace you want to edit the Barracuda XDR configuration for.

3. Go to Integration > Barracuda XDR. The Barracuda XDR page opens.

4. To change the Barracuda XDR configuration, edit the following settings:

• • Sites log streams to Barracuda XDR

  • Edge services log streams to Barracuda XDR

  • Barracuda XDR server and port settings

Modify Sites Stream to Barracuda XDR

1. Go to the Barracuda XDR page. To remove the specific site or multiple sites, click X. You can see that previously selected sites are removed.
   
2. To reconfigure sites, select the site you wish to add from the drop-down list, or type to search. 
3. Click Save.

After the configuration is complete, you can see that only the selected sites stream logs to Barracuda XDR.

Modify Edge Services Stream to Barracuda XDR

1. Go to the Barracuda XDR page. To remove the specific edge service or multiple edge services, click X.
   
2. To reconfigure the edge services, select the edge services you wish to add from the drop-down list, or type to search. 
3. Click Save.

After the configuration is complete, you can see that only the selected edge services stream logs to Barracuda XDR.

Modify the Barracuda XDR Server and Port Settings

1. Go to the Barracuda XDR configuration page. Edit the value for the field names such as Hostname and Port. 
   

2. Enter a valid hostname and port.
3. Click Save.

After the new configuration is complete, you can see that the selected sites or edge services in your workspace stream logs to the new Barracuda XDR server. 

Disable Barracuda XDR for a Workspace

1. Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.

2. In the left menu, click the Tenants/Workspaces icon and select the workspace you want to disable streaming for.

3. Go to Integration > Barracuda XDR.

4. The Barracuda XDR page opens. Click to disable Enable Streaming
   
5. Click Save.

After the configuration is complete, you can see that the connected sites or edge services in a selected workspace stop streaming their logs to Barracuda XDR.