FortiSIEM - Barracuda Web Filter Parser

[isuru]

Hi,

I have created a custom parser for Barracuda WAF (BarracudaWAFParser.xml). But I have encountered an issue since the logs are "comma-separated".

ex: <131>Nov 12 10:03:30 barracuda 2021-11-12 04:33:30.083 +0000 barracuda SYS REPORTS ERRO 44703 Report not sent to john@abc.com: Auth failed: 535 5.7.8 Error: authentication failed: authentication failure

for the above log event types, I have created to parse the logs as follows,

<when test="$_event = 'barracuda SYS'">

<!-- Barracuda System Log Fields -->
<!-- %md : Module Name -->
<!-- %ll : Log Level -->
<!-- %ei : Event ID -->
<!-- %ms : Message -->

<setEventAttribute attr="eventType">Barracuda-WAF-System</setEventAttribute>
<collectAndSetAttrByPos src="$_body" sep=" ">
<attrPosMap attr="module" pos="1"/>
<attrPosMap attr="logLevel" pos="2"/>
<attrPosMap attr="eventId" pos="3"/>
<attrPosMap attr="msg" pos="4"/>
</collectAndSetAttrByPos>
</when>​

The correct way to parse this log is as,

Module Name: REPORTS
Log Level: ERRO
Event ID: 44703
Message: Report not sent to john@abc.com: Auth failed: 535 5.7.8 Error: authentication failed: authentication failure


However, since the "Message" is also comma-separated, I can only retrieve the first Word (Report) of the whole message (not_parsing_correctly.png). In this type of scenario what would be the logical approach to parse the full message.

This happens to the rest of the Barracuda event types as well.

------------------------------
Cheers,
Isuru
------------------------------

[Gabe_FTNT]

Hi Isuru

why are you not using the system parser that does the job well?

<when test="$_logType = 'SYS'">
<!-- system logs -->
<switch>
<case>
<collectFieldsByRegex src="$_body">
<regex><![CDATA[<module:gPatWord>\s+<eventSeverityCat:gPatWord>\s+<_eventID:gPatInt>\s+<msg:gPatMesgBodyMin>\s*$]]></regex>
</collectFieldsByRegex>
<!-- e.g. Barracuda-Sys-51001 -->
<setEventAttribute attr="eventType">combineMsgId("Barracuda-Sys-", $_eventID)</setEventAttribute>
</case>
<default>
<setEventAttribute attr="eventType">Barracuda-Sys-Generic</setEventAttribute>
</default>
</switch>
</when>

To answer your question, yet, you'd have to applycollectAndSetAttrByPos only to the section of the log messages that can be separated by a space and identify that section first e.g. by a collectFieldsByRegex instead of applying it to the full _body. The system parser does not use the collectAndSetAttrByPos because it's probably easier to include the 3 fields directly in the collectFieldsByRegex

I hope this helps.

Regards,
Gabriel

------------------------------
Gabriel Kälin, Systems Engineer
Fortinet | Riedmühlestr. 8 | 8305 Dietlikon | Switzerland | E: gkaelin@fortinet.com | T: +41 79 882 80 98
------------------------------

[isuru]

Hi Gabriel,

Thanks for the insight. The out-of-the-box parser [FortiSIEM 5.2.6 (1623)] fails with the logs receiving to the SIEM (fortisiem_parser.png). Possibly due to the additional Syslog header. Is there a way to remove the Syslog header since I couldn't find it in the Barracuda configuration?

------------------------------
Cheers,
Isuru
------------------------------

[isuru]

Hi Gabriel,

Please find the original parser included in the FortiSIEM.

------------------------------
Cheers,
Isuru
------------------------------

[Gabe_FTNT]

Hi Isuru

I don't find any BarracudaWebFilterParser on my FortiSIEM 6.3.2 instance:

Yet, the log message you posted originally passes the system's BarracudaWAFParser:
The only issue I see with the parser is that it does not correctly categorize the ERRO as Event Severity Category "MEDIUM" because it compares to "ERROR" instead of just "ERRO" and then sets an non-existing attribute "severity" instead of "eventSeverity"


In green the corrected line that will correctly set the severity. The pieces in red likely need modification as well, but I don't have access to Barracuda logs.

​​Regards,
Gabriel

------------------------------
Gabriel Kälin, Systems Engineer
Fortinet | Riedmühlestr. 8 | 8305 Dietlikon | Switzerland | E: gkaelin@fortinet.com | T: +41 79 882 80 98
------------------------------

[isuru]

Hi Gabriel,

I'm referring to an older version of FortiSIEM [FortiSIEM 5.2.6 (1623)]. Could you please share with me the parser you have so I can test the same?

------------------------------
Cheers,
Isuru
------------------------------

[Gabe_FTNT · Accepted solution]

Isuru, please find the BarracudaWAFParser from FortiSIEM 6.3.2 attached.

Happy weekend!

------------------------------
Gabriel Kälin, Systems Engineer
Fortinet | Riedmühlestr. 8 | 8305 Dietlikon | Switzerland | E: gkaelin@fortinet.com | T: +41 79 882 80 98
------------------------------

[isuru]

Hi Gabriel,

Thanks!! Happy weekend!! 

------------------------------
Cheers,
Isuru
------------------------------