Citrix

Overview

Citrix consists of a Syslog Collector–based log source template called NetScaler, which collects, processes, and analyzes Citrix logs. It also normalizes Citrix events, making their data easier to search, correlate, and investigate.

The integration includes:

• CitrixNetScalerCompiledNormalizer and CitrixADCCompiledNormalizer to convert the parsed Citrix logs into a standardized format for consistent analysis across Logpoint.

• LP_Citrix NetScaler label package to standardize Citrix NetScaler events by mapping them to Logpoint labels, enabling consistent search, alerting, and dashboard support.

• LP_Citrix NetScaler report package provides predefined reports, enabling users to gain visibility into traffic patterns, authentication activity, system events, and potential security incidents.

• LP_Citrix NetScaler dashboard provides centralized visibility into normalized Citrix NetScaler logs, enabling monitoring of authentication activity, application access, web traffic patterns, and security-related events for investigation and analysis.

• The following Normalization packages convert raw Citrix logs into Logpoint’s standardized schema, ensuring consistent field mapping and enabling search, alerting, dashboards, and reporting.

  • LP_Citrix NetScaler

  • LP_Citrix Secure Gateway

  • LP_Citrix XenDesktop

  • LP_Citrix XenMobile

  • LP_Citrix SDWAN

Supported Events

• NetScaler v12.x, v11.x, v10.x, v14.1

Only a subset of Citrix NetScalar 14.1 Syslog logs are supported at the moment. For more information, see Log samples.

• Citrix Access Gateway