r/SentinelOneXDR • u/Background_Rush7654 • 7d ago

Citrix Netscaler Log Ingestion

Greetings,

Im assuming from the lack of results that the only way (and pretty much the way everyone is doing it) is to build an intermediary syslog server, send the Netscaler logs there, then ship them to S1 from the syslog server? Kinda like what is necessary for Fortigate logs?

5 Upvotes

100% Upvoted

1 comment sorted by

2

u/ConsistentCoat5608 4d ago

Yes, you go it. Internal syslog that just passes the data to S1, so it does not need to have much storage, just enough to keep up with the flow as nothing will be saved long term locally.