---
title: "Citrix NetScaler"
slug: "citrix-netscaler"
tags: ["Self Service Ingestion"]
updated: 2025-12-11T16:28:04Z
published: 2025-12-11T16:30:16Z
canonical: "docs.hunters.ai/citrix-netscaler"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Citrix NetScaler

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Citrix NetScaler Logs |  |  | ✅ | ✅ | citrix_netscalar_logs | Text | S3 |
| Citrix NetScaler AppFW Logs |  |  | ✅ | ✅ | citrix_netscalar_application_firewall_logs | CEF | S3 |

---

## Overview

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/2a5cf23-Citrix_Logo_Reg_RGB_Black.png?sv=2026-02-06&spr=https&st=2026-11-04T16%3A49%3A40Z&se=2026-11-04T17%3A49%3A40Z&sr=c&sp=r&sig=ydVyOhTpSmTfvQurbMzXlqPoQHgPbYGUYHEGsz%2B9llI%3D)Citrix NetScaler is an Application Delivery Controller (ADC) created to optimize, manage, and secure network traffic. It analyzes application-specific traffic to distribute, optimize, and protect Layer 4–Layer 7 (L4–L7) network traffic.

## Supported data types

****Citrix NetScaler Logs****

**Table name:** `citrix_netscalar_logs`

Syslog messages are generated by the NetScaler appliance to record operational information about the system, including error messages, warning messages, and informational messages. These logs can be forwarded to a centralized syslog server for aggregation and analysis, facilitating network management and monitoring.

****Citrix NetScaler AppFW Logs****

**Table name:** `citrix_netscalar_application_firewall_logs`

NetScaler AppFW is a web application firewall that provides comprehensive security for web applications by protecting them from various types of attacks, including SQL injection and cross-site scripting. It offers advanced features such as application behavior profiling and signature-based detection to ensure robust protection and compliance with security standards.

## Send data to Hunters

Hunters supports the integration of Citrix NetScaler logs using an intermediary S3 bucket.

**To send data to Hunters:**

1. Contact Citrix support to learn how to route your Citrix NetScaler logs to S3.
2. Follow [this guide](https://docs.netscaler.com/en-us/citrix-adc/current-release/system/audit-logging/reliable-syslog) to learn how to complete the process.

## Expected format

### Citrix NetScaler Logs

Logs are expected in text format.

```plaintext
07/27/2022:09:19:59 GMT SERVER 0-PPE-0 : default TCP CONN_DELINK 68288527 0 :  Source IP:PORT - Vserver IP - NatIP IP:PORT - Destination IP:PORT - Delink Time 07/27/2022:09:19:59 GMT - Total_bytes_send 0 - Total_bytes_recv 1650"}
1650
```

Additional supported format (Requires to contact support team after onboarding)

```plaintext
<134>1 2025-11-03T17:47:32Z example-host-02 API 0-PPE-0 - - default CMD_EXECUTED 17780 0 :  User example_user - ADM_User NONE - Remote_ip 10.0.0.1 - Command "show ns version" - Status "Success"
```

### Citrix NetScaler AppFW Logs

Logs are expected in CEF format.

```plaintext
CEF:0|Citrix|NetScaler|NS13.1|APPFW|APPFW_POLICY_HIT|6|src=10.11.8.83 spt=6388 method=POST request=test.com/clientxml/auth/login msg=Application Firewall profile invoked cn1=475386121 cn2=218288882 cs1=Tableau_WAF cs2=PPE0 cs4=ALERT cs5=2024 act=not blocked
```

Additional supported format (Requires to contact support team after onboarding)

```plaintext
<134>1 2025-11-03T18:58:45Z example-host-02 API 0-PPE-0 - - default CMD_EXECUTED 18213 0 :  User example_user - ADM_User NONE - Remote_ip 10.0.0.1 - Command "stat ns" - Status "Success"
```