cef0.barracuda.waf

Introduction

The table cef0.barracuda.waf identifies events in CEF format generated by Barracuda Web Application Firewall.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

cef0.barracuda.waf

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Log samples

The following are sample logs sent to cef0.barracuda.waf. Find how the information will be parsed in your data table under each sample log.

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

cef0.barracuda.waf

2021-09-01 08:17:48.919 localhost=127.0.0.1 14 CEF: 0|Barracuda|WAF|10.0.1.005|WF|Web Firewall Event|Medium| eventId=41940 app=HTTP customerURI=/All Customers/MSSP/EFZ_Customer/Customer art=1629271519917 deviceSeverity=4 act=DENY rt=1629271519917 src=217.99.150.19 sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/ARIN/214.0.0.0-219.253.255.255 (ARIN) spt=61212 dst=190.29.0.184 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 190.16.0.0-190.31.255.255 dpt=80 duser=""-"" request=thewright.nyc/.env requestMethod=GET requestContext=""-"" requestClientApplication=""Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/513.36 (KHTML, like Gecko) Chrome/81.0.1234.129 Safari/523.36"" cs1=NONE cs2=[""-""] cs3=""-"" cs4=217.99.150.19 cs5=SLASH_DOT_IN_URL flexString1=security-policy flexString2=GLOBAL cn1=61212 deviceCustomDate1=1629242639000 cs1Label=Followup Action cs2Label=Attack Details cs3Label=SessionID cs4Label=Proxy IP cs5Label=Attack Type cn1Label=Proxy Port deviceCustomDate1Label=Event date c6a4Label=North America flexString1Label=Rule flexString2Label=RuleType ahost=10.1.110.30 agt=10.1.110.30 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.1.0.0-10.1.255.255 amac=A8-15-63-BC-2F-AD av=8.0.0.8322.0 atz=UTC at=cef_multifolder_file dtz=UTC deviceProcessName=barracuda6 geid=9631526338573251840 _cefVer=0.1 aid=3TbWRKnsBABCACH-4e8Az9g\\=\\=

And this is how the log would be parsed:

Field	Value	Type	Extra fields	Source field name
eventdate	`2021-09-01 08:17:48.919`	`timestamp`
hostname	`macbook-pro.lan`	`str`
priorityCode	`14`	`str`
cefTag	`CEF`	`str`
cefVersion	`0`	`str`
embDeviceVendor	`Barracuda`	`str`
embDeviceProduct	`WAF`	`str`
deviceVersion	`10.0.1.005`	`str`
signatureID	`WF`	`str`
name	`Web Firewall Event`	`str`
severity	`Medium`	`str`
_cefVer	`0.1`	`str`
act	`DENY`	`str`
app	`HTTP`	`str`
c6a4Label	`North America`	`str`
cfp1Label	`null`	`str`
cfp1	`null`	`float8`
cn1Label	`Proxy Port`	`str`
cn1	`61212`	`int8`
cn2Label	`null`	`str`
cn2	`null`	`int8`
cn3Label	`null`	`str`
cn3	`null`	`int8`
cs1Label	`Followup Action`	`str`
cs1	`NONE`	`str`
cs2Label	`Attack Details`	`str`
cs2	`[""-""]`	`str`
cs3Label	`SessionID`	`str`
cs3	`""-""`	`str`
cs4Label	`Proxy IP`	`str`
cs4	`217.99.150.19`	`str`
cs5Label	`Attack Type`	`str`
cs5	`SLASH_DOT_IN_URL`	`str`
destinationTranslatedAddress	`null`	`ip4`
deviceCustomDate1Label	`Event date`	`str`
deviceCustomDate1	`2021-08-17 23:23:59.0`	`timestamp`
deviceProcessName	`barracuda6`	`str`
dhost	`null`	`str`
dst	`190.29.0.184`	`ip4`
dpt	`80`	`int4`
duid	`null`	`str`
duser	`""-""`	`str`
in		`int8`
msg	`null`	`str`
out	`null`	`int8`
requestClientApplication	`""Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/513.36 (KHTML, like Gecko) Chrome/81.0.1234.129 Safari/523.36""`	`str`
requestCookies	`null`	`str`
requestMethod	`GET`	`str`
request	`thewright.nyc/.env`	`str`
rt	`2021-08-18 07:25:19.917`	`timestamp`
src	`217.99.150.19`	`ip4`
spt	`61212`	`int4`
suid	`null`	`str`
agentZoneURI	`/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.1.0.0-10.1.255.255`	`str`
agt	`10.1.110.30`	`str`
ahost	`10.1.110.30`	`str`
aid	`3TbWRKnsBABCACH-4e8Az9g\=\=`	`str`
amac	`A8-15-63-BC-2F-AD`	`str`
art	`1629271519917`	`str`
at	`cef_multifolder_file`	`str`
atz	`UTC`	`str`
av	`8.0.0.8322.0`	`str`
customerURI	`/All Customers/MSSP/EFZ_Customer/Customer`	`str`
destinationTranslatedZoneURI	`null`	`str`
destinationZoneURI	`/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 190.16.0.0-190.31.255.255`	`str`
deviceSeverity	`4`	`str`
dtz	`UTC`	`str`
eventId	`41940`	`str`
flexString1	`security-policy`	`str`
flexString1Label	`Rule`	`str`
flexString2	`GLOBAL`	`str`
flexString2Label	`RuleType`	`str`
geid	`9631526338573251840`	`str`
requestContext	`""-""`	`str`
sourceZoneURI	`/All Zones/ArcSight System/Public Address Space Zones/ARIN/214.0.0.0-219.253.255.255 (ARIN)`	`str`
hostchain	`localhost=127.0.0.1`	`str`	✓
tag	`CEF`	`str`	✓	`cefTag`
rawMessage		`str`	✓