Barracuda WAF: Add new integration

packages/barracuda/_dev/build/docs/README.md

@@ -2,17 +2,35 @@
 
 This integration is for Barracuda device's logs. It includes the following
 datasets for receiving logs over syslog or read from a file:
+
 - `waf` dataset: supports Barracuda Web Application Firewall logs.
-- `spamfirewall` dataset: supports Barracuda Spam Firewall logs.
 
-### Waf
+Use the Barracuda WAF data stream to ingest log data. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference `data_stream.dataset:barracuda.waf` when troubleshooting an issue.
 
-The `waf` dataset collects Barracuda Web Application Firewall logs.
+## Upgrade
 
-{{fields "waf"}}
+The Technical preview `spamfirewall` data stream has been deprecated and removed, as of v1.0 of this integration. As we work on a replacement for the Spam Firewall integration, you can continue to use the [Spam Firewall filebeat module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-barracuda.html).
+
+## WAF
+
+Barracuda Web Application Firewall protects applications, APIs, and mobile app backends against a variety of attacks including the OWASP Top 10, zero-day threats, data leakage, and application-layer denial of service (DoS) attacks. By combining signature-based policies and positive security with robust anomaly-detection capabilities, Barracuda Web Application Firewall can defeat today’s most sophisticated attacks targeting your web applications.
+
+### Requirements
+
+This integration is built and tested against the Barracuda Web Application Firewall version **12.1**. Earlier versions may work, but have not been tested.
 
-### Spamfirewall
+You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it.
+You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
 
-The `spamfirewall` dataset collects Barracuda Spam Firewall logs.
+### Setup
 
-{{fields "spamfirewall"}}
+For step-by-step instructions on how to set up an integration, see the
+[Getting started](https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html) guide.
+
+### WAF Events
+
+The `barracuda.waf` dataset provides events from the configured syslog server. All Barracuda WAF syslog specific fields are available in the `barracuda.waf` field group.
+
+{{event "waf"}}
+
+{{fields "waf"}}

packages/barracuda/_dev/deploy/docker/docker-compose.yml

@@ -1,38 +1,23 @@
-version: '2.3'
+version: "2.3"
 services:
-  barracuda-spamfirewall-logfile:
-    image: alpine
+  barracuda-waf-tls:
+    image: docker.elastic.co/observability/stream:v0.8.0
     volumes:
       - ./sample_logs:/sample_logs:ro
-      - ${SERVICE_LOGS_DIR}:/var/log
-    command: /bin/sh -c "cp /sample_logs/* /var/log/"
-  barracuda-spamfirewall-udp:
-    image: akroh/stream:v0.2.0
+    command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9581 -p=tls --insecure /sample_logs/barracuda.log
+  barracuda-waf-tcp:
+    image: docker.elastic.co/observability/stream:v0.8.0
     volumes:
       - ./sample_logs:/sample_logs:ro
-    entrypoint: /bin/bash
-    command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9540 -p=udp /sample_logs/barracuda-spamfirewall-*.log"
-  barracuda-spamfirewall-tcp:
-    image: akroh/stream:v0.2.0
+    command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9580 -p=tcp /sample_logs/barracuda.log
+  barracuda-waf-udp:
+    image: docker.elastic.co/observability/stream:v0.8.0
     volumes:
       - ./sample_logs:/sample_logs:ro
-    entrypoint: /bin/bash
-    command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9540 -p=tcp /sample_logs/barracuda-spamfirewall-*.log"
+    command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9580 -p=udp /sample_logs/barracuda.log
   barracuda-waf-logfile:
     image: alpine
     volumes:
       - ./sample_logs:/sample_logs:ro
       - ${SERVICE_LOGS_DIR}:/var/log
     command: /bin/sh -c "cp /sample_logs/* /var/log/"
-  barracuda-waf-udp:
-    image: akroh/stream:v0.2.0
-    volumes:
-      - ./sample_logs:/sample_logs:ro
-    entrypoint: /bin/bash
-    command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9525 -p=udp /sample_logs/barracuda-waf-*.log"
-  barracuda-waf-tcp:
-    image: akroh/stream:v0.2.0
-    volumes:
-      - ./sample_logs:/sample_logs:ro
-    entrypoint: /bin/bash
-    command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9525 -p=tcp /sample_logs/barracuda-waf-*.log"