NetScaler VPN

NetScaler VPN by Citrix allows you to gather information about user activity.

Before You Begin

You must configure and enable the syslog option on NetScaler so that InsightIDR can collect its logs. Read instructions here: https://support.citrix.com/article/CTX121728.

Create a backup of your configuration before changing NetScaler

In the NetScaler application, go to Configuration > System > Backup & Restore and enter your backup settings.

Configure InsightIDR to collect data from the event source

After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.

To configure the new event source in InsightIDR:

  1. From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.
  2. Do one of the following:
    • Search for NetScaler VPN in the event sources search bar.
    • In the Product Type filter, select VPN.
  3. Select the NetScaler VPN event source tile.
  4. Choose your collector and event source. You can also name your event source if you want.
  5. Choose the timezone that matches the location of your event source logs.
  6. Optionally choose to send unparsed logs.
  7. Configure your default domain and any Advanced Event Source Settings.
  8. Select Listen on Network Port. Enter the port you used for your syslog or rsyslog configuration.
    • Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
  9. Click Save.