Setting up ATR for Barracuda Incident Response

Setting up ATR

The documentation below outlines the requirements for the Barracuda XDR Automated Threat Response (ATR) for Barracuda Incident Response.

Requirements

You must have:

• Access to the Barracuda XDR Dashboard set up and functioning properly

• An XDR Cloud Security license

• Access to Barracuda Incident Response set up and functioning properly

• A Microsoft 365 ATR integration set up and functioning properly

Configuring the Microsoft 365 integration

To configure the Microsoft 365 Integration to support remediation actions for Automated Threat Response, you must add additional API permissions to the registered application, by following the instructions below.

Conditional access policy and named location

You must also add a conditional access policy named Barracuda_XDR_Policy_Blocked_IPs that includes a named location called Barracuda_XDR_Email_ATR_Block_IP.

See Configuring the Microsoft 365 integration for ATR for procedure.

Enabling ATR in the XDR Dashboard

Once you have configured the Microsoft 365 integration, you must enable ATR in the XDR Dashboard.

To enable ATR in XDR Dashboard

1. In the Barracuda XDR Dashboard, click Integrations .

2. Click the Barracuda Incident Response card.

   Open

   

3. On the Barracuda Impersonation Protection card, click one of the following

   • If Barracuda Impersonation Protection is already set up, Update .

   • If Barracuda Impersonation Protection is already set up, Setup .

4. Select Enable ATR.

5. In Block List Policy Name, enter the Named Location created in your conditional access policy.
   If you followed the procedure in Configuring the Microsoft 365 integration for ATR correctly, the named location is Barracuda_XDR_Email_ATR_Block_IP.

5. Click Save.