Sumo Logic Integration

Sumo is a third-party log management and analytics service, transforming your data into sources of operations, security, and compliance intelligence. The Barracuda CloudGen Firewall app provides a dashboard to monitor actions, IP addresses, and rule and application usage. Data is imported into Sumo via syslog streaming of the Firewall logs.

Open

• Configure a cloud syslog source in your Sumo account. For the Source Category, it is recommended to use a self-explanatory name like 'CGFW'.
  For information and help, see also https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-Syslog-Source.

• Run and configure syslog-ng on a host within your network.
  For information and help, see also https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-Syslog-Source#Send_data_to_cloud_syslog_source_with_syslog-ng.

Configure and enable syslog streaming for every Barracuda CloudGen Firewall you want to include in the Sumo app.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. Click Lock.

3. Set Enable the Syslog service to yes.

4. Click Send Changes and Activate.

Define profiles specifying the log file types to be transferred / streamed.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select Logdata Filters.

3. Click Lock.

4. Click + to add a new filter.

5. Enter an expressive Name that refers to Sumo, e.g., SumoFilter.

6. Click OK.

7. The Filters window opens.

8. Click + in the Data Selection table and select Firewall_Audit_Log.

   Fatal_log and Panic_log data can also be streamed to the Sumo server but are currently not processed by the Barracuda CloudGen Firewall Sumo app.

9. In the Affected Box Logdata section, select All from the Data Selector drop-down menu.

10. In the Affected Service Logdata section, select All from the Data Selector list.

11. Click OK.

12. Click Send Changes and Activate.

Configure the data transfer settings for the Sumo server. You can optionally choose to send all syslog data via an SSL-encrypted connection.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select Logstream Destinations.

3. Click Lock.

4. Click + in the Destinations table.

5. The Destinations window opens.

6. For Name, enter an expressive name that refers to Sumo, e.g., Sumo.

7. Click OK.

8. The window for configuring the specific destination to Sumo is displayed.

9. Configure the syslog-ng server logstream destination:

   1. Logstream Destination – Select explicit-IP.

   2. Destination – Enter the IP address of the syslog-ng server that will be forwarding logs to Sumo.

   3. Destination Port – Enter 5140 for plaintext of 5141 for SSL-encrypted connections.

   4. Transmission Mode – Select TCP or UDP (only for unencrypted connections).

   5. (optional) Explicit Source IP – Enter the management IP address of the Barracuda CloudGen Firewall, or leave blank for the CloudGen Firewall to do a routing lookup to determine the sender IP address.

   6. (optional) Use SSL Encapsulation – Select yes to send the syslog stream over an SSL-encrypted connection.

   7. (optional) Peer SSL Certificate – Import the SSL certificate configured on the syslog-ng server for this stream.

   8. Override Node Name – Select no.

10. Click OK.

11. Click Send Changes and Activate.

Create a logdata stream configuration combining the previously configured Log Destinations and Log Filters.

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select Logdata Streams.

3. Click Lock.

4. Click + in the Streams table.

5. Enter a Name and click OK.

6. The Streams window opens.

7. In the Log Destinations table, click + and select the Log Destination created in Step 1.3, e.g., Sumo.

8. In the Log Filters table, click + and select the Log Filter created in Step 1.2, e.g., SumoFilter.

9. Click OK.

10. Click Send Changes and Activate.

As a first step, you must activate web log streaming:

1. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select Logdata Streams.

3. Click Lock.

4. Enable Web Log Streaming – Select yes.

As the second step, you must configure the web log syslog streaming:

1. Streaming Protocol – Select TCP or UDP (only for unencrypted connections).

2. Destination IP Address – Enter the IP address of the syslog-ng server that will be forwarding logs to Sumo.

3. Destination Port – Enter 5140 for plaintext or 5141 for SSL-encrypted connections.

4. SSL ... (optional) – Configure the key and certificates to send logs to this server.