How to Integrate Citrix NetScaler with Azure Sentinel?

[MiteshAgrawal]

Hi Everyone,

Hope you guys are doing good amid this pandemic.

I want to integrate Citrix NetScaler ith Azure Sentinel. I have found the below link to configure Citrix NetScaler to forward logs,

https://support.citrix.com/article/CTX121728

I want to know what steps needs to be taken at Azure Sentinel end. I read that we need to have a Linux machine on Azure or on VM in premise which will collect logs from NetScaler or any other syslog and will forward to the Sentinel.

Please help with the steps to be carried out at Sentinel end for successful integration.

Regards,

Mitesh Agrawal

[#2]

@MiteshAgrawal Once you have the Syslog forwarder setup, just install the Log Analytics agent from Azure Sentinel. Go into the Syslog Data Connector in Azure Sentinel for the instructions (including downloading and installing the Log Analytics agent for Linux)...

[#3]

Hi @Rod_Trent ,

Thanks for the quick reply. Can't we get logs without using any Linux machine in betweeen?

Regards,

Mitesh Agrawal

[#4]

@MiteshAgrawal If the Citrix device can support other formats like .csv or .json, then you could use a Windows box as the forwarder. Just setup a custom log (https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-custom-logs) and install the Log Analytics agent on the Windows box.

Not suggesting I know that the Citrix device supports that, but you'll have to check with the vendor to see if they provide alternate instructions.

[#5]

@Rod_Trent, so if I use Windows forwarder, then I need to write a custom parser to parse the logs received from the forwarder to Azure right? Do we have any documents by following which I can write such parsers.

Also, I have one more doubt. Whether can we use the same windows forwarder for Citrix forwarder and any other syslog device? I mean how Azure will differentiate between the log sources if they both can use the same?

Please help.

Regards,

Mitesh Agrawal

[#6]

Hi @MiteshAgrawal 

This is what I found in Citrix help documents.v And it is useful in Azure WVD as well.

An Excerpt:

How to integrate Citrix Analytics with Azure Sentinel

Follow the guidelines mentioned to integrate Citrix Analytics with Azure Sentinel:

• Data export. Citrix Analytics creates a channel and exports risk intelligence. Azure Sentinel retrieves this risk intelligence from the channel.

• Get configuration on Citrix Analytics. Create an account with Citrix Analytics to authenticate the Azure Sentinel integration. Citrix Analytics uses the account to prepare a configuration file required for the integration. The configuration file is used to configure the Citrix Analytics Adapter for Azure Sentinel.

• Download Citrix Analytics Adapter for Azure Sentinel. Download the Citrix Analytics Adapter for Azure Sentinel application from GitHub. The adapter is a Python program that consumes alerts from a tenant-specific Kafka topic that is hosted by Citrix Analytics. You can run the adapter on any physical or virtual machine with Python 2.7 or above. The consumed alerts are posted to Azure Sentinel using REST API.

• Install Citrix Analytics Adapter for Azure Sentinel. Install the Citrix Analytics Adapter for Azure Sentinel application on a machine so that it can receive the Kafka data. The adapter contains placeholder variables for connecting to Azure Sentinel and the Kafka interface on Citrix Analytics. After installing the adapter, do the following:

  • Replace the placeholder variables related to the Kafka interface with the values obtained from the configuration file that Citrix Analytics has prepared.

  • Replace the Azure Sentinel related placeholder variables (for Workspace ID and API Key) with the respective values from your Azure account.

I hope this helps!

Regards.

Abigail

[#7]

After the adapter is installed and configured, do the following:

Open your Azure Sentinel Workspace in the Azure portal.

In the Configuration section, select Data connectors.

Select the Citrix Analytics Data Connector and select the Open connector page. Follow the instructions to connect the events to Azure Sentinel.

Select the Next steps tab and select the recommended Workbook to view the sample queries.

[#8]

Hi @Abigail05,

Hope you are doing good. Thanks for your reply.

 I believe Citrix Analytics and Citrix NetScaler are different right? Citrix NetScaler in our case is an on-prem solution while Citrix Analytics is a cloud service as an Analytics platform. 

Please help.

Regards,

Mitesh Agrawal

[#9]

Hi @Smith_J ,

Is Citrix Analytics and Citrix NetScaler the same device?

Regards,

Mitesh Agrawal

[#10]

I came here looking for answers to a similar question and thought I'd share some info about the citirx products.

Citrix Analytics is a service like Azure Sentinel.  It collects logs from different Citrix components and provides analytics for their products.

The netscaler is a citrix device that does a lot of things.  

If someone is looking to forward netscaler logs to Sentinel, they're going to come in as syslog to the linux collector.  Analytics wouldn't come into play unless they were already using Citrix Analytics.

Hope that helps...