How are you protecting your Netscaler Gateway from dictionary attacks? GeoIP? Is it possible to run in Monitoring Mode to see where the attacks are coming from?

IP reputation via responder policy , max login attempts + timeout and then keeping an eye on failed authentication attempts on gateway insights in Netscaler console/ADM and blocking any suspicious IPs on firewall as well as specific countries

You can also enable using the BOT detection and use the NIST OWASP tags as the dictionary attacks usually use a known BOT to do the attack. https://community.citrix.com/articles/security/whats-new-netscaler-application-security-updates-a-recap-of-2023-r202/