Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-netscaleradc

NetScaler ADC

You can integrate NetScaler ADC (formerly Citrix ADC) with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

NetScaler ADC product overview

NetScaler ADC (formerly Citrix ADC) is an application delivery controller that performs application-specific traffic analysis to intelligently distribute, optimize, and secure Layer 4 to Layer 7 network traffic for web applications, with integrated security and application firewall protection.

What we ingest

Sophos XDR collects NetScaler ADC syslog data by listening for messages your appliance forwards to a Sophos XDR data collector. The following log categories are collected:

  • Web and application firewall activity: HTTP transactions and Application Firewall violations.
  • Authentication and VPN: AAA and SSL VPN authentication and session events.
  • Configuration and management: Administrative command execution.
  • Network traffic 1: TCP connection setup and teardown events.

Event and data types

We ingest the following event and data types from NetScaler ADC:

  • Web and application firewall activity: HTTP transactions and Application Firewall (App FW) violations, such as denied URLs, buffer overflow, and cross-site scripting, with the URL and action. Normalized to HTTP telemetry.
  • Authentication and VPN: AAA and SSL VPN authentication and session events, including login, logout, and failures, with user and result. Normalized to authentication telemetry.
  • Configuration and management: Administrative command execution via the CLI, GUI, and API. Normalized to management event telemetry.
  • Network traffic1: TCP connection setup and teardown events, including source and destination addresses and ports. Normalized to netflow telemetry.

Data provided by this integration

Data provided by NetScaler ADC gets normalized to the following schemas:

  • auth
  • http
  • managementevent
  • netflow 1

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation

  1. Netflow telemetry is only available with a Sophos Next-Gen SIEM subscription. See Sophos Next-Gen SIEM overview. ↩↩↩