Barracuda Load Balancer Request Denial Burst
Detects a burst of denied requests at the load balancer. The appliance sits in front of the application and sees attempts the application never receives, which makes it an early warning layer that most estates collect and never query. Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webserver where sourcename='BARRACUDA-LOADBALANCER' and action='REQUEST_DENIED' | duration 15m | groupby srcip, useragent | select srcip, useragent, distinct_count(url) | having distinct_count_col1 > 20
Sigma
