The May release of Barracuda XDR includes:

New Dashboard features

The following new features have been added to the Dashboard:

More intuitive navigation

The Barracuda Managed XDR Dashboard now has a more modern design and improved organization.

You can now find what you need easier and in a more intuitive way.

In addition, the Home button now takes you directly to BarracudaONE for easier cross-product access. For information about BarracudaONE, see BarracudaONE.

Open

The new XDR navigation

ATR for Impersonation Protection and Incident Response

Barracuda Managed XDR now includes Automated Threat Response (ATR) for XDR Email Security, the first email-specific ATR in the platform and exclusive to Barracuda Email Protection.

You can enable ATR for either of the following:

• Setting up ATR for Barracuda Impersonation Protection

• Setting up ATR for Barracuda Incident Response

When Barracuda Email Protection with Impersonation Protection or Incident Response detects account takeover, spear phishing, or Business Email Compromise (BEC), ATR can automatically disable compromised customers in Microsoft 365 environments.

Email threats are contained in seconds without manual intervention, reducing Mean Time To Respond (MTTR) from hours to seconds.

You can also manually disable users, block malicious IPs, and remove inbox rules.

ATR for Sophos Central

Automated Threat Response (ATR) is now available for Sophos Central/EDR. Monitored XDR Endpoint Security customers using Sophos can now benefit from instant, automated threat containment when high-confidence threats are detected.

Sophos Central/EDR joins CrowdStrike and Microsoft Defender for Endpoint as supported ATR platforms.

To set up ATR for Sophos Central, see Setting up ATR for Sophos Central ATR.

Integration with Stormshield

XDR Network Security now covers widely used European firewalls from Stormshield
Detections include:

• configuration changes from external IPs,

• brute force authentication attempts,

• security threat simulations, and more.

To integrate Stormshield, see Integrating Stormshield Network Security (SNS).

Integration with pfSense

XDR Network Security now covers popular open-source firewalls from pfSense.
Detections include:

• inbound and outbound traffic involving IPs with high threat scores,

• allowed port scans,

• users logging in from threatening IPs, and more.

To integrate pfSense, see Integrating pfSense.

Query multiple datasources Log Search

You can now use log search to query multiple datasources with a single query. This gives you more flexibility, allows for more in-depth queries, and saves you time by avoiding multiple queries

To query multiple datasources, see Querying Data Source Logs with Generative AI.

Datasources added to Log Search

The following sources of data have been added to Log Search::

• ZScaler

• pfSense

• Ubiquiti

• Stormshield

• Suricata

• Cisco Firepower Threat Defense

For more information, see Querying Data Source Logs with Generative AI.

Dashboard bug fixes

New Rules

• CloudGen Firewall DDoS Detection (V1) - Uses an ML model to understand what "normal" looks like for each service over 60 days of history and flags windows that deviate significantly across volume, source diversity, and protocol dimensions.

Rule tuning and bug fixes

• GLB.AA.LNX Linux Brute Force User - Rule modified and tuned to avoid false positives. Before modification rule was looking at org wide Brute force, now its checking BF in the combination of org id,hostname and username

• ClickFix STAR Custom Rule Update - Rule logic updated to catch a wider array of Clickfix based attacks

• Windows Potential DCSync Attack - Rule logic updated to specify elevated permissions required for activity to alert - this reduces observed false positives

• Crowdstrike rule modifications - Rule logic modified to comply with the updated fieldnames from Crowdstrike. Earlier, the rule was taking outdated field names hence did not trigger rules. After the changes, rules will now successfully trigger based on correct field names and alert customers for events detected by Crowdstrike

• GLB.AD.EPP Malware Traffic Detected

• GLB.AD.EPP CrowdStrike Detection Summary Event

• GLB.AD.EPP CrowdStrike Attempted to Quarantine a Malicious File

• GLB.AD.EPP Batch File Write To System32

Barracuda Email Protection Rule Updates:

Null check fixes to ensure rules run smoothly:

• Barracuda EGD User Account Created

• Barracuda EGD Email IP Matched with Threat IP

• Barracuda EGD Brute Force Authentication User Attempt

• Barracuda EGD Mass Phishing Campaign Detected

• Barracuda Impersonation Protection - Account Takeover - Multiple Inbox Rules

• Barracuda Impersonation Protection - Account Takeover - Multiple Sign Ins

• Barracuda Impersonation Protection Multiple Spear Phishing Attempts - Spam

• Barracuda Incident Response - Multiple Users Reported Suspicious Email

Google Workspace Admin Revoked Token or Cookies - Added correlation to check if Admin has history of revoking tokens/cookies 

Google Workspace Unusual Login :

• Added Correlation to check SentinelOne for host device from source ip 

• User history lookback to suppress new users 

• Added ASN + City correlation 

Office 365 Anomalous Login : Added Correlation to check SentinelOne for host device from source IP 

Retired Rules

• Barracuda EGD Bulk Account Modifications Detected

Rules Enhanced with SOAR

• GLB.MD.EPP Sophos Central Detected Mimikatz Activity

• GLB.EB.EPP Sophos Central Core Outbreak Detected

• GLB.AD.EPP Sophos Central Detected BloodHound

• GLB.AD.EPP Sophos Central Detected Impacket Hack Tool

• Windows Rule Automations

  • Windows Multiple Accounts Disabled by Administrator

  • Windows Potential NTLMv1 Downgrade Attack Attempt

  • Windows Deletion of Boot Configuration Data by Bcdedit