I've been evaluating our Barracuda CloudGen deployment's logging capabilities against our existing on-premise SIEM (Splunk Enterprise). The vendor documentation provides high-level guidance but lacks the concrete configuration details needed for a production-ready integration. After several days of testing, I've documented a reproducible method that addresses three critical gaps:
* Parsing the CloudGen event format (JSON with nested structures)
* Handling timestamp normalization across timezones
* Filtering the high-volume, low-signal administrative events
The core of the integration is a Splunk HTTP Event Collector (HEC) configuration paired with a CloudGen Custom Log Forwarding script. Here is the working `forwarder.conf` template I deployed to the Control Center:
```json
{
"version": "1.0",
"forwarders": [
{
"type": "http",
"name": "SIEM_HEC_Forwarder",
"config": {
"url": "https://your-splunk-server:8088/services/collector",
"token": "YOUR_HEC_TOKEN",
"method": "POST",
"headers": {
"Content-Type": "application/json"
},
"format": "json",
"batch_size": 100,
"timeout": 30
},
"filters": [
{
"source": "firewall",
"severity": ["alert", "critical"],
"exclude_subtype": ["system_health", "config_backup"]
}
]
}
]
}
```
The most significant hurdle was event normalization. CloudGen logs use a proprietary `event_timestamp` field with a different format than our SIEM's expected `_time` field. This required a custom props.conf and transforms.conf on the Splunk indexer to map and extract the fields correctly. Without this step, all events were parsed under a single timestamp, breaking correlation.
My preliminary evaluation shows this setup processing approximately 1,200 EPS (events per second) with a consistent sub-2-second latency from event generation to SIEM visibility. The filtering reduces data volume by an estimated 40%, focusing on security-relevant traffic and connection logs.
I'm interested in comparisons with other SIEMs like QRadar or ArcSight. Has anyone implemented similar log forwarding and encountered issues with sustained throughput during peak traffic? Additionally, what methods are you using to validate log integrity and ensure no drop between the CloudGen fabric and your central log repository?