Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add schema fields for Barracuda Web Proxies #74

Open
damianharouff opened this issue Mar 14, 2023 · 0 comments
Open

Add schema fields for Barracuda Web Proxies #74

damianharouff opened this issue Mar 14, 2023 · 0 comments
Labels
documentation Improvements or additions to documentation triaged

Comments

@damianharouff
Copy link

Customer request per HS-1473167439

Please describe what you are requesting
The customer uses Baracuda Proxies, and a few fields are missing in the schema. Here is a documentation of the Logs from baracuda:

https://campus.barracuda.com/product/websecuritygateway/doc/6160435/syslog-and-the-barracuda-web-security-gateway/?lang=2AJYS

Describe what change you are proposing
http_content_category - matches the field of Matched Category of that
documentation

http_content_category_reason - matches the field of "Matched Part" for
that category

http_referrer_category_Matechedcategory - quite self explaining

http_referrer_domain - quite self explaining

http_referrer_url - quite self explaining

threat_name - here the value of "Spy ID"

threat_action - here the value of "Spy Type"

From customer:
"threat_name" is a field we would use for the Field "Spy ID" from Barracuda Security Gateways. It contains the name of spyware if something is blocked because of said spyware.
We want to use the "threat_action" for the "Spy Type", also from Barracuda Security Gateways. In this case it contains numbers from one to six, depending on what predefined action the system took. But I see it as a more general field, that's supposed to contain the action a system took to prevent/remediate some threat(usually as a text-field).

Describe the log source
Barracuda Web Security Gateway: https://www.barracuda.com/products/network-security/web-security-gateway/features

Attach any sample logs or examples for details
"How to parse" and example logs at: https://campus.barracuda.com/product/websecuritygateway/doc/6160435/syslog-and-the-barracuda-web-security-gateway/

@miwent miwent added documentation Improvements or additions to documentation triaged labels Mar 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation triaged
Projects
None yet
Development

No branches or pull requests

2 participants