Decoders for Barracuda Email Security Gateway (ESG)

[Sergio Agudo Cantalapiedra]

Hi,

I have just configured Barracuda ESG syslog client to wazuh server and now the logs are being collected correctly. The problem is that the default decoders (0045-barracuda_decoders.xml) seems not working. Also, I don't have any rule on the server.

This is one log from ESG:

Apr 14 17:38:25 192.168.30.250  outbound/smtp: 127.0.0.1 1744645101-187f7884ff458930001-kHL6ZB 0 0 SEND ENC 1 3E8BF1C4B76 250 2.6.0 <20250414-17381452-3168-0@N-EXT-IIS-02> [InternalId=70433168706971, Hostname=AM8P189MB1218.EURP189.PROD.OUTLOOK.COM] 21788 bytes in 0.100, 211.328 KB/sec Queued mail for delivery #to#zener-es.mail.protection.outlook.com[52.101.73.26]:25

I don't understand how the decoders work. Could you please help me with this?

Thanks in advance, regards.

[Stuti Gupta]

Hi Sergio,

You need to create custom rules and decoders like:

Add the custom decoder at /var/ossec/etc/decoders/local_decoder.xml, like:

<decoder name="outbound">
        <prematch>outbound/smtp</prematch>
</decoder>

<decoder name="outbound_child">
        <parent>outbound</parent>
        <regex>outbound/smtp: (\d+.\d+.\d+.\d+) (\.+) \d \d (\.+) ENC \d (\.+) (\d+) \d.\d.\d (\S+) [InternalId=(\.+), Hostname=(\.+)] (\d+) bytes in \.+, \.+ KB/sec (\.+)\p+to\p
+(\.+)[(\.+)]:(\.+)</regex>
        <order>smtp_client, session_id,msg_action,session_token,SMTP_response_code,message_id,InternalId,host_name,msg_size,info,destination_mail,ip_address,dst_port</order>
</decoder>

You can  modify this decoder as your requirement

Then, add the costom rule at /var/ossec/etc/rules/local_rules.xml, like:

<group name="smtp">
<rule id="100406" level="5">
        <decoded_as>outbound</decoded_as>
        <field name="msg_action">SEND</field>
        <description>stmp: $(info)</description>
</rule>
</group>

Test the rule in wazuh-logtest or ruleset test. Once you are satisfied with the results, restart the wazuh-manager to apply the changes.



To know more about custom rules and decoders, please refer to https://documentation.wazuh.com/current/user-manual/ruleset/index.html

Let me know if you need any further assistance!

[Sergio Agudo Cantalapiedra]

Hi Stuti,

I've just included the indicated custom decoders and rule but when I tried to trigger an alert with this log, it doesn't appear as yours. Attaching a pic showing it:

Thanks in advance, regards.

.

[Stuti Gupta]

The regex should be one line. In the previous response, there is a  typo error, so please replace the old one with the following one:

<decoder name="outbound_child">
        <parent>outbound</parent>

        <regex>outbound/smtp: (\d+.\d+.\d+.\d+) (\.+) \d \d (\.+) ENC \d (\.+) (\d+) \d.\d.\d (\S+) [InternalId=(\.+), Hostname=(\.+)] (\d+) bytes in \.+, \.+ KB/sec (\.+)\p+to\p+(\.+)[(\.+)]:(\.+)</regex>

        <order>smtp_client, session_id,msg_action,session_token,SMTP_response_code,message_id,InternalId,host_name,msg_size,info,destination_mail,ip_address,dst_port</order>
</decoder>

[Sergio Agudo Cantalapiedra]

Hi,

I forgot to thank you for the last update, it helped me. I'm trying now to create another decoder, this time, for this log:

Jun 13 10:37:38 192.168.30.250  scan: egress-ip47b.ess.de.barracuda.com[35.157.190.238] 1749803855-187f789adc5fdb0001-vXqMmy 1749803856 1749803858 SCAN ENC simon....@vantagetowers.com xinru...@zener.de 0.012 0 0 - SZ:107198 SUBJ:=?iso-8859-1?Q?AW:_W=FCrzburg,_Friedrich-Spee-Str._58-60,=5F4283F_-_Fotos?==?iso-8859-1?Q?_BTB_Elektrto_22.05.2025_Ergebnis?=

I create the following:

<decoder name="barracuda_scan">
  <prematch>scan</prematch>
</decoder>

<decoder name="scan_child">
  <parent>barracuda_scan</parent>
  <regex>scan: (\S+)[(\d+.\d+.\d+.\d+)] \.+ \.+ (\.+) ENC (\.+) (\.+) (\d+) (\d+) - \.+ SUBJ:(\.+)</regex>
  <order>outbound_server, outbound_ip, msg_action, sender_mail, destination_mail, virus_score, spam_score, asunto</order>
</decoder>

I attach the result. I don't know where is the problem. Coudl you help me?

Thanks in advance, regards.