Barracuda Load Balancer Configuration Changed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects configuration changes on a Barracuda load balancer. Load balancer configuration decides where traffic goes; altering a backend pool redirects users to a destination of the attacker's choosing while the hostname and certificate they see remain entirely legitimate. Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='BARRACUDA-LOADBALANCER' and action='CONFIGURATION_CHANGED' | groupby user, config