You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Please describe what you are requesting
The customer uses Baracuda Proxies, and a few fields are missing in the schema. Here is a documentation of the Logs from baracuda:
From customer:
"threat_name" is a field we would use for the Field "Spy ID" from Barracuda Security Gateways. It contains the name of spyware if something is blocked because of said spyware.
We want to use the "threat_action" for the "Spy Type", also from Barracuda Security Gateways. In this case it contains numbers from one to six, depending on what predefined action the system took. But I see it as a more general field, that's supposed to contain the action a system took to prevent/remediate some threat(usually as a text-field).
Customer request per HS-1473167439
Please describe what you are requesting
The customer uses Baracuda Proxies, and a few fields are missing in the schema. Here is a documentation of the Logs from baracuda:
https://campus.barracuda.com/product/websecuritygateway/doc/6160435/syslog-and-the-barracuda-web-security-gateway/?lang=2AJYS
Describe what change you are proposing
http_content_category - matches the field of Matched Category of that
documentation
http_content_category_reason - matches the field of "Matched Part" for
that category
http_referrer_category_Matechedcategory - quite self explaining
http_referrer_domain - quite self explaining
http_referrer_url - quite self explaining
threat_name - here the value of "Spy ID"
threat_action - here the value of "Spy Type"
From customer:
"threat_name" is a field we would use for the Field "Spy ID" from Barracuda Security Gateways. It contains the name of spyware if something is blocked because of said spyware.
We want to use the "threat_action" for the "Spy Type", also from Barracuda Security Gateways. In this case it contains numbers from one to six, depending on what predefined action the system took. But I see it as a more general field, that's supposed to contain the action a system took to prevent/remediate some threat(usually as a text-field).
Describe the log source
Barracuda Web Security Gateway: https://www.barracuda.com/products/network-security/web-security-gateway/features
Attach any sample logs or examples for details
"How to parse" and example logs at: https://campus.barracuda.com/product/websecuritygateway/doc/6160435/syslog-and-the-barracuda-web-security-gateway/
The text was updated successfully, but these errors were encountered: