이 파서는 키-값 형식의 Citrix Netscaler SYSLOG 로그를 처리하여 message 필드에서 JSON 형식 데이터를 추출하고, host.hostname 및 user_agent.original와 같은 다른 필드의 정보를 삭제한 후 UDM을 보강합니다. 기본 메시지가 비어 있는 경우 원래 로그 메시지로 대체하여 처리합니다.
'VserverServicePort' 필드에서 추출한 값입니다. 'CITRIX'로 하드코딩됨 'NETSCALER'로 하드코딩됩니다. 'CITRIX_NETSCALER'로 하드코딩됩니다. product_event_type을 기반으로 파서에 의해 결정됩니다. 예: NETWORK_CONNECTION, USER_LOGIN, USER_LOGOUT, USER_STATS, STATUS_UPDATE, USER_UNCATEGORIZED, GENERIC_EVENT 로그 접두사에서 추출한 값입니다 (예: CONN_DELINK, CONN_TERMINATE, OTHERCONN_DELINK 등) 이벤트에 대한 간단한 설명입니다. '이유' 또는 'Failure_reason'과 같은 다른 필드에서 파생되기도 합니다. 로그 항목의 날짜 및 시간 필드에서 계산됩니다. 파서는 다양한 형식과 시간대를 처리합니다. 'username:domainname' 필드에서 콜론 뒤의 부분을 가져옵니다. metadata.product_event_type에 'TCP'가 있는 이벤트의 경우 TCP로 하드코딩됩니다. 로그인 및 명령이 성공한 경우 ALLOW로 설정하고, 로그인 실패 및 차단된 리소스 액세스의 경우 BLOCK으로 설정합니다. '상태', 'Failure_reason', 'Access'와 같은 필드에서 파생됩니다. 사용자 이름과 비밀번호가 인증에 사용되는 경우 USERNAME_PASSWORD로 설정됩니다 (특정 로그 메시지에서 추론됨). VPN 관련 로그인/로그아웃 이벤트의 경우 VPN으로 설정됩니다. 사용자 에이전트 파싱 라이브러리를 사용하여 network.http.user_agent 필드에서 파싱됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis document details the process of collecting NetScaler logs for Google Security Operations using a forwarder, focusing on configuring both NetScaler VPX and SDX.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eCITRIX_NETSCALER\u003c/code\u003e ingestion label is used by the parser to normalize raw log data into a structured UDM format.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring NetScaler VPX involves verifying hostname settings, creating an auditing server with specific log level and format configurations, and binding the created audit policy.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring NetScaler SDX requires verifying hostname settings, setting up the syslog server, and defining the syslog parameters, including date format and time zone.\u003c/p\u003e\n"],["\u003cp\u003eThe provided parser maps various NetScaler log fields to corresponding UDM fields, including security results, network details, and principal/target information, offering comprehensive log data analysis.\u003c/p\u003e\n"]]],[],null,["# Collect NetScaler logs\n======================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the NetScaler logs by using a Google Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations overview](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser which normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the `CITRIX_NETSCALER`\ningestion label.\n\nConfigure NetScaler VPX\n-----------------------\n\nTo configure the NetScaler VPX to send logs to the Google Security Operations forwarder,\ndo the following:\n\n- [Verify hostname configuration](#verify-hostname-configuration).\n- [Create auditing server](#create-auditing-server).\n- [Bind the created audit policy to the server](#bind-created-audit-policy-to-server).\n\n### Verify hostname configuration\n\n1. Sign in to the NetScaler web interface using administrator credentials.\n2. Select **Configuration \\\u003e Settings**.\n3. Click **Host name, DNS IP address, and Time zone**.\n4. If the **Host name** field is empty, enter the hostname. Don't include spaces. If this field is already configured, then no action is required.\n5. In the **DNS IP address** field, verify if the local DNS IP address is specified.\n6. In the **Time zone** field, enter your time zone.\n\n### Create auditing server\n\n1. In the NetScaler web interface, select **Configuration \\\u003e System \\\u003e Auditing \\\u003e Syslog \\\u003e Servers**.\n2. Specify the syslog details in the following fields:\n - **Name**\n - **Server type**\n - **IP address**\n - **Port**\n3. Select **Log levels** as **Custom**.\n4. Select all checkboxes except **DEBUG** level in the configuration.\n5. In the **Log facility** list, select **LOCAL0**.\n6. In the **Date format** list, select **MMDDYYYY**.\n7. Select **Time zone** as **GMT**.\n8. Clear the following checkboxes:\n - **TCP logging**\n - **ACL logging**\n - **User configurable log messages**\n - **AppFlow logging**\n - **Large scale NAT logging**\n - **ALG messages logging**\n - **Subscriber logging**\n - **DNS**\n - **SSL interception**\n - **URL filtering**\n - **Content inspection logging**\n9. Click **Ok** to create the auditing server.\n\n### Bind the created audit policy to the server\n\n1. In the NetScaler web interface, select **Configuration \\\u003e System \\\u003e Auditing \\\u003e Syslog**.\n2. Click **Policies** tab.\n3. In the **Name** field, enter a name for the policy.\n4. In the **Server** list, select the policy from the previous section.\n5. Click **Create**.\n6. Right-click the created auditing policy and select **Action \\\u003e Global bindings**.\n7. Click **Add binding**.\n8. In the **Policy binding** window, do the following:\n 1. In the **Select policy** field, enter the created audit policy.\n 2. In the **Binding details** pane, in the **Priority** field, enter **120** as it is the default priority.\n 3. Click **Bind**.\n\n| **Note:** Priority is a numeric value that indicates when this policy is evaluated relative to other policies. Access Gateway gives precedence to a policy with lower priority.\n\nConfigure NetScaler SDX\n-----------------------\n\nTo configure the NetScaler SDX to send logs to the Google Security Operations forwarder,\ndo the following:\n\n- [Verify hostname configuration for NetScaler SDX](#verify-hostname-configuration-for-netscaler-sdx).\n- [Configure the syslog server](#configure-syslog-server).\n- [Configure the syslog parameters](#configure-syslog-parameters).\n\n### Verify hostname configuration for NetScaler SDX\n\n1. Sign in to the NetScaler web interface using administrator credentials.\n2. In the NetScaler web interface, select **System \\\u003e System settings**.\n3. If the **Host name** field is empty, enter the hostname. Don't include spaces. If this field is already configured, then no action is required.\n4. In the **Time zone** field, select **UTC** or **GMT**.\n\n### Configure the syslog server\n\n1. In the NetScaler web interface, select **System \\\u003e Notifications \\\u003e Syslog servers**.\n2. In the **Details** pane, click **Add**.\n3. In the **Create syslog server** window, specify values for the following syslog server parameters:\n 1. In the **Name** field, enter a name.\n 2. In the **IP address** field, enter the Google Security Operations forwarder IP address.\n 3. In the **Port** field, port number.\n 4. Select **Log levels** as **Custom**.\n 5. Select all log levels except **Debug**.\n4. Click **Create**.\n\n### Configure the syslog parameters\n\n1. In the NetScaler web interface, select **System \\\u003e Notifications \\\u003e Syslog servers**.\n2. In the **Details** pane, click **Syslog parameters**.\n3. In the **Configure syslog parameters** page, select **Date format** as **MMDDYYYY** and select **Time zone** as **GMT**.\n4. Click **Ok**.\n\nConfigure the Google Security Operations forwarder to ingest NetScaler logs\n---------------------------------------------------------------------------\n\n1. Select **SIEM Settings** \\\u003e **Forwarders**.\n2. Click **Add new forwarder**.\n3. In the **Forwarder name** field, enter a unique name for the forwarder.\n4. Click **Submit** and then click **Confirm** . The forwarder is added and the **Add collector configuration** window appears.\n5. In the **Collector name** field, type a unique name for the collector.\n6. Select **Citrix NetScaler** as the **Log type**.\n7. In the **Collector type** field, select **Syslog**.\n8. Configure the following mandatory input parameters:\n - **Protocol**: specify the connection protocol that the collector uses to listen to syslog data.\n - **Address**: specify the target IP address or hostname where the collector resides and listens to syslog data.\n - **Port**: specify the target port where the collector resides and listens to syslog data.\n9. Click **Submit**.\n\nFor more information about the Google Security Operations forwarders, see [Manage forwarder configurations through the Google Security Operations UI](/chronicle/docs/install/forwarder-management-configurations).\n\nIf you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/getting-support).\n\nField mapping reference\n-----------------------\n\nThis parser processes Citrix Netscaler SYSLOG logs in key-value format, extracting JSON-formatted data from the `message` field and enriching the UDM with information from other fields like `host.hostname` and `user_agent.original` after sanitizing them. It handles cases where the primary message is empty by falling back to the original log message.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
