Skip to content

Citrix Netscaler Web Logs

Citrix

About

Citrix Netscaler Web Logs are generated by Citrix ADC, which is "..the most comprehensive application delivery and load balancing solution for small and medium-size businesses. Which means you can deliver a better user experience, on any device—anywhere."

Product Details

Vendor URL: Citrix ADC

Product Type: Web Proxy

Product Tier: Tier II

Integration Method: Syslog

Integration URL: Integratin guide

Log Guide: Configuring Web Logs

Parser Details

Log Format: W3C

Expected Normalization Rate: near 100%

Data Label: CITRIX_NETSCALER_WEB_LOGS

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
"Citrix Netscaler Web" metadata.product_name
"Citrix" metadata.vendor_name
"NETWORK_CONNECTION" metadata.event_type
bytes_received network.received_bytes
bytes_sent network.sent_bytes
local_ip target.ip
local_port target.port
method network.http.method
referer network.http.referral_url
remote_ip principal.ip
status network.http.response_code
url_path_requested target.url
user_agent "network.http.user_agent

Product Event Types

Event UDM Event Classification
All NETWORK_CONNECTION

Log Samples

2021-11-19 13:31:56 10.10.10.1 - HTTP 10.1.2.3 443 POST /autodiscover/autodiscover.xml - 200 818 1033 0 HTTP/1.1 "AppleExchangeWebServices/818.0.1 accountsd/113" "X-BackEndCookie=S-1-5-21-redacted" "-" "-" 0 10434 - -�

Sample Parsing

metadata.event_timestamp = "2021-11-19T17:21:34Z"
metadata.event_type = "NETWORK_CONNECTION"
metadata.vendor_name = "Citrix"
metadata.product_name = "Citrix Netscaler Web"
principal.ip = "10.1.2.3"
principal.asset.ip = "10.1.2.3"
target.ip = "10.2.3.4"
target.port = 443
target.url = "/autodiscover/autodiscover.xml"
target.asset.ip = "10.2.3.4"
network.sent_bytes = "1033"
network.received_bytes = "818"
network.http.method = "POST"
network.http.referral_url = "-"
network.http.user_agent = "AppleExchangeWebServices/818.0.1 accountsd/113"
network.http.response_code = 200

Parser Alerting

This product currently does not have any Parser-based Alerting

Rules

Coming Soon