It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda XDR

Setting up the XDR Collector for Barracuda IDS for Windows

  • Last updated on

This setup is for the XDR Collector only. If you are using a physical or virtual sensor, refer to Integrating Barracuda IDS.

The XDR Collector runs as a service in your environment. While the minimum specifications are listed below, the required resources depend on the number of active integrations and the amount of data being processed.

Install the XDR Collector on each server you want to monitor. 

Minimum Requirements

To set up the XDR Collector, the minimum requirements are the following:

Minimum requirements
CPU2vCPU
Disk Size10GB SSD
Memory1GB
Network interface card (NICs)2

Operating System

  • Windows Server 2016 and higher
  • Windows 10 and higher

Windows Server 2022  is recommended.

IP Address Requirements

Two private static IP addresses are required, one for each Ethernet interface.

Required Endpoint/Port Communication

The XDR Collector must be able to communicate to the following endpoints/ports:

Logstash

a96190b49bd294a5fbb3725ff20aab78-c7f64fe7557a87d2.elb.us-east-1.amazonaws.com:5044

Management Server

b5e9a5096e0a4f7782cc444c8edbbd5e.fleet.us-east-1.aws.found.io:443

Update Server

artifacts.elastic.co:443

Setting up the XDR Collector

To set up the XDR Collector, you must do the following procedures:
  • To configure a static IP address
  • To install the XDR Collector
  • To set up switch port mirroring
  • To install Suricata
To Configure a Static IP Address

Configure a static IP address for each Ethernet interface. See the documentation for your specific version of Windows.

To install the XDR Collector

The install command is unique for each account and should only be run on systems within that account's network.

  1. In Barracuda XDR Dashboard, click Infrastructure Collectors.
  2. In the Policies table, next to the on-prem policy, click Action Install.
  3. Click Windows.
    WindowsInstallXDRCollector1.png
  4. Copy the command at the bottom of the dialog box.
    WindowsInstallXDRCollector2.png
  5. On the appropriate system, run Powershell as an administrator, paste the command, and run it.

It may take up to 30 minutes for the install to complete.

To set up Switch Port Mirroring
  1. Connect the secondary Ethernet interface on the XDR Collector's host machine to the mirrored port on the switch.
  2. Configure the switch to mirror traffic in both directions on all other ports on the switch.
To install Suricata 
  1. Download and install NPCAP (https://npcap.com/#download)

    NPCAP allows Windows software to capture raw network traffic.
  2. Download and install Suricata from https://suricata.io/download/
    Pic 1.png
  3. As Administrator, open PowerShell and navigate to the Suricata installation directory (C:\ProgramFiles\Suricata)
  4. Install the Suricata service with the following option:
    .\suricata.exe -c .\suricata.yaml -i <X.X.X.X> --service-install
    Where <X.X.X.X> is the IP address of the host machine's port connected to the switch port-mirroring destination port.
  5. While keeping the PowerShell terminal active, open the services.msc interface and start the Suricata service
    Pic 2.png
  6. In services.msc, set the Suricata service properties startup type to "Automatic (Delayed Start)" and the recovery options to "Restart the Service" after 2 minutes.

    Pic 3.png Pic 4.png


Suricata should now be running in the background. To verify that Suricata is generating new entries in the log file, run the following command in the directory where you installed Suricata (By default, the installation directory is C:\Program Files\Suricata\):
Get-Content .\log\eve.json -Wait -Tail 10
Important Notes
  • If the number of source ports in the switch mirroring session is greater than or equal to 24, then it is recommended to increase the cache memory of Suricata from the default value of 1MB to 8MB.
  • Add the executable for both Suricata and XDR Collector to the Allow List in all antivirus and endpoint protection software (except in SentinelOne)
    • Suricata: "C:\Program Files\Suricata\suricata.exe"
    • XDR Collector: "C:\Program Files\Elastic\Agent\elastic-agent.exe"
  • Do not upgrade either Suricata or the XDR Collector without confirmation from XDR support as this may result in configuration discrepancies. Barracuda XDR Collector upgrades are managed by Barracuda Networks.
  • If the IP address of the host's secondary interface is changed, stop and delete the Suricata service, then repeat step 2. To delete the service, run the following command as Administrator:
    sc.exe delete Suricata