Barracuda Incident Response Updates

Incident now includes external users

2023-05-16T17:23:58.025Z

Incident Response now includes external users (outside your organization) as part of impact radius when an incident is created. You can view external and internal users under “USERS” tab while viewing incident details. However, we cannot track if these external users clicked on a link (if one was present), forwarded the email, opened an email or replied to the email.

https://campus.barracuda.com/product/forensics/doc/79463566/reviewing-incidents/

Include a comment while creating a sender policy

2022-10-26T18:35:56.774Z

Creating a sender policy while creating an Incident in IR, lets you add a comment that can be seen alongside the policy in Email Gateway Defense (EGD). If you include a comment, it will show alongside the new policy in EGD

Added by Incident Response will be included with the new policy if the comment field is left blank.

Campus Update:
https://campus.barracuda.com/product/forensics/doc/79463562/creating-an-incident

Send a User List to Security Awareness Training

2022-09-30T18:39:20.084Z

Incident Response can create a group of users involved in an incident and send it to Barracuda Security Awareness Training. This training group is comprised of each user's email address.

You must have a Security Awareness Training account to use this feature.

More info: https://campus.barracuda.com/product/forensics/doc/98209214

Microsoft Teams Notifications

2022-09-29T23:46:00.169Z

Automated Workflows can now send notifications to Microsoft Teams. See Automated Workflows Settings for configuration information.

An example of a notification in Microsoft Teams:

Ability to search email body using keywords or URL

2022-07-28T22:37:22.576Z

You are now able to search in the body of the message using keywords up to 200 characters and search for a URL within the body of the message.

View incident details page has also been updated to show this search criteria, if used. This gives additional fields you can search for, when creating an incident.

Creating an incident for investigation

2022-04-04T21:46:12.905Z

You can now create an incident to investigate the impact of the incident without deleting emails or any remediation action.

You can review how many emails will be deleted and how your end users interacted with these emails. Once you have reviewed and have completed the investigation, you can click on the button “Delete emails” to delete the emails impacted.

Please note that this will not add sender policies in Email Gateway Defense or block traffic on Barracuda Content Shield. However, you can enable Continuous Remediation after deleting emails.

New template added to Automated Workflows

2022-03-01T18:31:31.474Z

Rather than creating a completely new automated workflow, you can use workflow templates as a starting point to create workflows for common scenarios. For example, you can use the User-reported Message - Create Incident - Specific User template to create a workflow to create an incident whenever a specific user reports a message. When you select the template, the workflow appears automatically. On the left side of the page, you are prompted to complete the condition, in this case, to specify the user who is reporting the message. You can optionally change other parts of the workflow, for example, to change the condition to add another user, to add the number of affected mailboxes, and so on. Be sure to specify a unique name for each workflow you create.

Additional workflow templates will be added over time.

Creating an Automated Workflow using a Template

To create an automated workflow using a template:

Open Incident Response.
From the menu in the upper left corner, select Automated Workflows.
On the Automated Workflows page, click Create Workflow.
Under Workflow Templates, a specific template, such as User-reported Message - Create Incident - Specific User, to use as the basis for creating a workflow.
Provide a unique name for the workflow.
Optional. Provide a description for the workflow.
On the left side of the page, red text indicates conditions you must enter to customize the template. In this example, provide the email address for the user who is reporting emails. Complete the information. Notice it automatically updates in the workflow.
Optionally add more conditions or actions, as described in the section above.
Review the graphical representation of the workflow. If needed, take actions as described in the section above.
Click Create Workflow.
The workflow appears in table on the Automated Workflows page. It is ready to launch whenever it is triggered.

More information, please visit campus

Review your settings now

2021-12-07T22:26:06.482Z

With unifying the settings in this release, by default, Automatic Remediation now deletes incident-related emails from users’ mailboxes. From the Menu button, click Settings to confirm your settings

Settings - all in one place!

2021-12-06T17:21:15.304Z

You can now access all the settings for Incident Response through the left-hand menu.

As part of this, in addition to moving emails that were automatically remediated by the system, you can also now delete emails permanently from end-user mailboxes, when this setting is enabled.

Learn more: https://campus.barracuda.com/product/forensics/doc/93195407/settings-before-you-begin/

NEW! Email Protection SaaS Plans

2021-12-06T16:24:28.785Z

They’re here! We are excited to announce the general availability of our new email protection plans. As part of our mission to provide innovative security products that are easy to buy, deploy, and use, our new plans are designed to better align with customer’s Office 365 security needs and buying preferences. As an existing customer there will be no changes to your products or plans. However, some features have new, more descriptive names and have undergone small changes. For more information on the new plans please visit https://campus.barracuda.com/doc/96014231/