Managed XDR Dashboard Features and Updates

Faster answers, enabled by AI

The Barracuda XDR SOC team is now enabled with SOC Bailey, an Agentic AI Assistant that improves response times for customers looking for help. When you asks a question on low and medium level alert tickets, Bailey investigates it across our security data and sends an evidence-based answer, typically within 1 to 5 minutes.

Safe by design

Customer data isolation. System-enforced organization scoping; the AI cannot choose a different customer’s data.
Read-only customer-response workflow. Bailey investigates without changing or deleting customer data.
Every answer evaluated. The Evaluator approves or escalates uncertain responses to an analyst.
Evidence-backed and traceable. Conclusions are tied to logs and full audit trails.
Scoped and tested. Initially for low- and medium-priority ticket questions; automated prompt-injection and data-leakage checks run on changes.

More information in the Alert timeline

The Alert timelines now includes Host names.

Removal of button from Alarms

The Respond to SOC button has been removed from Alarms.

XDR SOC Features and Updates

Updated Alarms to automatically close after creation
Removed the follow up alert notification on alarms
Databricks rule subjects for tickets are now able to use the dynamic values and tickets ATR took action on will have their subject updated accordingly
Ticket Stitching now has a set requirement to be an alert type to account for alerts that get changed to alarms
Added line to SOC bailey messages saying This message was personally reviewed and curated by the SOC Bailey AI Agent. If you'd like to speak with our team directly, please reply with "Request analyst review" and a member of our team will get back to you shortly.
- This was in the agentic ai replies but not Bailey’s
Cisco Umbrella Malware Detected And Not Blocked: Added additional context to rule when traffic type is NS, MX or or SOA. As they are approved Umbrella DNS activity and show as approved even when blocked.
Plain text passwords are no longer included in tickets from the C6G lookup

Rule updates

	Tuned Detection	Customer Facing Tuning Description

	Tuned Detection	Customer Facing Tuning Description
1	Microsoft Office 365 Anomalous Login	Low severity alerts from a common region will be sent as alarms for correlation purposes. If the region is not common, a low severity alert will only be sent if the country and/or the user agent is unusual. Otherwise, the alert is converted and sent out as an alarm for correlation purposes.
2	FortiGate Suspicious SSL-VPN Login	High severity alerts are more closely tuned to real compromises seen in the wild. If multiple users from the same organization are logging in under similar geo-locations, those alerts will be converted to alarms for correlation purposes. Authorized activity occurring from a /16 CIDR range is dropped.
3	Google Workspace Unusual Login	High severity alerts are more closely tuned to real compromises seen in the wild. If multiple users from the same organization are logging in under similar geo-locations, those alerts will be converted to alarms for correlation purposes. Authorized activity occurring from a /16 CIDR range is dropped.
4	Microsoft Office 365 Sparse Activity Account Anomalous Login	Alerts are sent when malicious infrastructure that is commonly seen across compromises is being utilized. Otherwise, the alert is converted and sent out as an alarm for correlation purposes.
5	Barracuda WaaS Geo Blocked IP Persistence Detected	This WaaS rule has been decommissioned following customer feedback.
6	Windows Suspicious Scheduled Task Creation	Added an exclusion for the legitimate Microsoft Entra Connect Health connectivity task to reduce false positives caused by routine health checks.
7	Microsoft Office 365 Conditional Access Policy Block from New Geolocation	Alerts have been converted to alarms for correlation purposes.
8	Microsoft Office 365 Login From Malicious IP Address	Dropped low severity alerts to alarm only for correlation purposes.
9	Microsoft Office 365 Email Forwarding Rule Created Modified or Deleted	Added lookback to check for anomalous sign on that correlates with rule creation
10	GLB.AU.CAS DUO Logon from Anomalous Location	Added stricter alerting criteria for new users + dropped users with EP key history
11	Azure New Service Principal Created	Added lookback to check for activity surrounding service principal creation
12	GLB.AU.CAS Okta: Impossible Travel	Dropped low severity alerts to alarm only for correlation purposes.
13	Microsoft Office 365 Suspicious New Inbox Rule Created	Added logic to catch additional suspicious inbox rule names. Inbox rules are correlated to user login activity to determine if legit. Multiple rapid inbox rules created by the same user are deduplicated based on surrounding context.
14	Windows User added to High Risk Security Enabled Group	Narrowed criteria to only fire on Built in Administrator groups for alerts, kept other activity as alarms. Also added IP enrichment to the overall severity calculation.
15	Microsoft Office 365 User Removed From Global Administrator Role	Narrowed criteria to only fire on Built in Administrator groups for alerts, kept other activity as alarms. Also added IP enrichment to the overall severity calculation.
16	Microsoft Office 365 User Added to Global Administrator Role	Narrowed criteria to only fire on Built in Administrator groups for alerts, kept other activity as alarms. Also added IP enrichment to the overall severity calculation.
17	Windows User Removed From High Risk Security Enabled Group	Narrowed criteria to only fire on Built in Administrator groups for alerts, kept other activity as alarms. Also added IP enrichment to the overall severity calculation.
18	Microsoft Office 365 User Accounts Password Spraying	Dropped low severity alerts to alarm only for correlation purposes.
19	Google Workspace Suspended User Re-enabled	Alerts have been converted to alarms for correlation purposes.

1

SentinelOne detections have officially been migrated to Databricks.

SentinelOne Agent Disabled
SentinelOne Agent Network Unquarantined
SentinelOne Anti-Tampering Disabled
SentinelOne Device Network Quarantined
SentinelOne Global Two Factor Modified
SentinelOne Group Deleted
SentinelOne New Threat Not Mitigated
SentinelOne User Added
SentinelOne User Deleted
SentinelOne User Modified Hash
SentinelOne User Permissions Modified
SentinelOne User Shutdown Agent
SentinelOne User Two Factor Modified
SentinelOne XDR Alert

	New Feature / Feature Updates	Feature Description

	New Feature / Feature Updates	Feature Description
1	Auto Exceptions	If we see the same observables present in multiple tickets for the same detection over multiple days for the organization, an exception will be created if it is authorized and not a true compromise. All closures codes assigned by customers allow for this feature to work.

Barracuda XDR Release Notes — October 2026