// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant. Prepend a table (CommonSecurityLog or Syslog) and map fields yourself.
// ===== barracuda_admin_login.yml
"admin" and ("login" or "logged in" or "authenticated")

// ===== barracuda_admin_port_inbound_internet.yml
((dst_ip in~ ("192.0.2.10", "192.0.2.11")) and (dst_port in~ ("443", "8000", "8443", "22"))) and (not((ipv4_is_in_range(src_ip, "10.0.0.0/8") or ipv4_is_in_range(src_ip, "172.16.0.0/12") or ipv4_is_in_range(src_ip, "192.168.0.0/16"))))

// ===== barracuda_appliance_outbound.yml
(src_ip in~ ("192.0.2.10", "192.0.2.11")) and (not((ipv4_is_in_range(dst_ip, "10.0.0.0/8") or ipv4_is_in_range(dst_ip, "172.16.0.0/12") or ipv4_is_in_range(dst_ip, "192.168.0.0/16"))))

// ===== barracuda_config_restore_import.yml
("config" or "backup") and ("restor" or "import")

// ===== barracuda_timezone_config_change.yml
"timezone" or "time zone"

// ===== barracuda_timezone_shell_metachar.yml
("timezone" or "time zone") and (";" or "|" or "`" or "$(" or "&&")

