# sigma convert -t kusto --without-pipeline (3 Nov 2026). azure_monitor, sentinel_asim and microsoft_xdr pipelines FAIL for all 5 rules: no table mapping for product barracuda / category firewall. Prepend a table (CommonSecurityLog or Syslog) and map fields yourself.

// barracuda_admin_login.yml
"admin" and ("login" or "logged in" or "authenticated")

// barracuda_admin_port_inbound_internet.yml
((dst_ip in~ ("192.0.2.10", "192.0.2.11")) and (dst_port in~ ("443", "8000", "8443", "22"))) and (not((ipv4_is_in_range(src_ip, "10.0.0.0/8") or ipv4_is_in_range(src_ip, "172.16.0.0/12") or ipv4_is_in_range(src_ip, "192.168.0.0/16"))))

// barracuda_appliance_outbound.yml
(src_ip in~ ("192.0.2.10", "192.0.2.11")) and (not((ipv4_is_in_range(dst_ip, "10.0.0.0/8") or ipv4_is_in_range(dst_ip, "172.16.0.0/12") or ipv4_is_in_range(dst_ip, "192.168.0.0/16"))))

// barracuda_timezone_config_change.yml
"timezone" or "time zone"

// barracuda_timezone_shell_metachar.yml
("timezone" or "time zone") and (";" or "|" or "`" or "$(" or "&&")
