{
    "id": "CitrixADC",
    "title":  "[Deprecated] Citrix ADC (former NetScaler)",
    "publisher": "Citrix",
    "descriptionMarkdown": "The [Citrix ADC (former NetScaler)](https://www.citrix.com/products/citrix-adc/) data connector provides the capability to ingest Citrix ADC logs into Microsoft Sentinel. If you want to ingest Citrix WAF logs into Microsoft Sentinel, refer this [documentation](https://learn.microsoft.com/azure/sentinel/data-connectors/citrix-waf-web-app-firewall)",
    "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "CitrixADC",
            "baseQuery": "CitrixADCEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Event Types",
            "query": "CitrixADCEvent\n | where isnotempty(EventType)\n    | summarize count() by EventType\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog",
            "lastDataReceivedQuery": "CitrixADCEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "CitrixADCEvent\n |  where TimeGenerated > ago(3d)\n    | take 1\n | project IsConnected = true"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
			}
        ]
    },
    "instructionSteps": [
        { 
            "title": "", 
            "description": ">**NOTE:** 1. This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias CitrixADCEvent and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Citrix%20ADC/Parsers/CitrixADCEvent.yaml), this function maps Citrix ADC (former NetScaler) events to Advanced Security Information Model [ASIM](https://docs.microsoft.com/azure/sentinel/normalization). The function usually takes 10-15 minutes to activate after solution installation/update. \n\n>**NOTE:** 2. This parser requires a watchlist named **`Sources_by_SourceType`** \n\n> i. If you don't have watchlist already created, please click [here](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FASIM%2Fdeploy%2FWatchlists%2FASimSourceType.json) to create. \n\n> ii. Open watchlist **`Sources_by_SourceType`** and add entries for this data source.\n\n> iii. The SourceType value for CitrixADC is **`CitrixADC`**. \n\n> You can refer [this](https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers?WT.mc_id=Portal-fx#configure-the-sources-relevant-to-a-source-specific-parser) documentation for more details",
            "instructions": [ 
            ]    
        },
        { 
                    "title": "1. Install and onboard the agent for Linux", 
                    "description": "Typically, you should install the agent on a different computer from the one on which the logs are generated.\n\n>  Syslog logs are collected only from **Linux** agents.", 
                    "instructions": [ 
                        { 
                        "parameters": { 
                        "title": "Choose where to install the agent:", 
            "instructionSteps": [ 
                    { 
                    "title": "Install agent on Azure Linux Virtual Machine", 
                    "description": "Select the machine to install the agent on and then click **Connect**.", 
                    "instructions": [ 
                        { 
                        "parameters": { 
                        "linkType": "InstallAgentOnLinuxVirtualMachine" 
                        }, 
                        "type": "InstallAgent" 
                        } 
                    ]    
                }, 
                    { 
                    "title": "Install agent on a non-Azure Linux Machine", 
                    "description": "Download the agent on the relevant machine and follow the instructions.", 
                    "instructions": [ 
                        { 
                        "parameters": { 
                        "linkType": "InstallAgentOnLinuxNonAzure" 
                        }, 
                        "type": "InstallAgent" 
                        } 
                    ] 
                } 
            ] 
                }, 
                    "type": "InstructionStepsGroup" 
                    } 
                ] 
                    }, 
            { 
                    "title": "2. Configure the logs to be collected", 
                    "description": "Configure the facilities you want to collect and their severities.\n 1. Under workspace advanced settings **Configuration**, select **Data** and then **Syslog**.\n 2. Select **Apply below configuration to my machines** and select the facilities and severities.\n 3.  Click **Save**.",
                    "instructions": [
                        {
                            "parameters": { 
                                "linkType": "OpenSyslogSettings"
                            },
                            "type": "InstallAgent"
                        }
                    ]
                },
        {
            "title": "3. Configure Citrix ADC to forward logs via Syslog",
            "description": "3.1 Navigate to **Configuration tab > System > Auditing > Syslog > Servers tab**\n\n 3.2 Specify **Syslog action name**.\n\n 3.3 Set IP address of remote Syslog server and port.\n\n 3.4 Set **Transport type** as **TCP** or **UDP** depending on your remote Syslog server configuration.\n\n 3.5 You can refer Citrix ADC (former NetScaler) [documentation](https://docs.netscaler.com/) for more details."
        },
		{
            "title": "4. Check logs in Microsoft Sentinel",
            "description": "Open Log Analytics to check if the logs are received using the Syslog schema.\n\n>**NOTE:** It may take up to 15 minutes before new logs will appear in Syslog table.",
            "instructions": []    
        }		
    ],
    "metadata" : {
        "id": "c546d5dd-dfec-41fb-a680-af0c66531adc",
        "version": "1.0.1",
        "kind": "dataConnector",
        "source": {
            "kind": "solution"
        },
        "author": {
            "name": "Microsoft"
        },
        "support": {
            "name": "Microsoft",
            "link": "https://support.microsoft.com/",
            "tier": "Microsoft"
        }
    }
}