Integrating Barracuda Incident Response

To integrate Barracuda Incident Response, do the following procedures below:

• To set up Barracuda Incident Response for integration

• To enable the Barracuda Incident Response integration in Barracuda XDR

To set up Barracuda Incident Response for integration

1. Sign in to Barracuda Incident Response.

2. On the left-hand side, click Settings.

3. Click the Syslog Options tab.

4. Toggle Enabled to on.

5. In IP Address/Hostname, enter barracuda-forensics.skout-build.com.

6. In Port, enter 6514.

   Open

   

7. Click Save.

8. While still in the Incident Response app, in your browser's location bar, copy the UUID Portion of the URL and save it to use in the To enable the Barracuda Incident Response integration in Barracuda XDR procedure.
   For example: If the url is https://forensics.barracudanetworks.com/report/xxxx-1234-5678-abcd-zzzz/dashboard , then the UUID is xxxx-1234-5678-abcd-zzzz.

   Open

   

To enable the Barracuda Incident Response integration in Barracuda XDR

1. In Barracuda XDR dashboard, click Integrations .

2. Click the Barracuda Incident Response card.

   Open

   

3. Do the following:

   • In Tenant ID, enter the UUID.

   • Check the Enabled box.

     Open

     

4. Click Save.

Set Up the API (Optional)

The second step is setting up the API, so that you can create incidents directly from Barracuda XDR Dashboard. This step is optional and not used by the SOC.

1. Create a Client ID and Client Secret. Log in to the Barracuda Token Service at https://login.bts.barracudanetworks.com/register. If you are not currently logged into Barracuda Cloud Control (BCC), you must log in using your BCC user credentials before you are redirected to the Barracuda Token Service.

2. Click Add Application in the top right.

3. On the Add Application page, in the Application Details section, fill in the Application name. In the Application Scope section, select following the account level checkboxes:

   • Email Gateway Defense

   • Incident Response

4. Click Add Application to register your application.

5. On the Application Details page, you can copy your Client ID and Client Secret to the clipboard and enter these values into the appropriate fields on Administration > Integrations > Barracuda Incident Response. The Client Secret is only available to copy for 15 minutes. However, you can reset it at any time.