Doing some more thought experiments on this. Has ...
# citrix-netscalerj
Jeff Riechers
06/03/2025, 12:59 PMDoing some more thought experiments on this. Has anyone ever done an http callout to the netscaler restapi? Thinking about modifying some authentication failures to have the NetScaler put the bad IP into a block dataset.
r
Richard Faulkner
06/04/2025, 12:23 AMNot in RestAPI but it sounds like you’re wanting to do step 5 in this article. I know there are steps out there to create the rules etc. https://community.citrix.com/articles/security/system_62_63_70/netscaler-attack-mitigation-r393/
Richard Faulkner
06/04/2025, 12:24 AMIt is resident in memory do the blocked IPs go away when you reboot.
j
Jeff Riechers
06/05/2025, 12:16 PMYeah, that is what me started on this. Wanted to make something permanent that can be exported out and sent to another machine. Right now I am digging through ADM logs, but might just have to build an external web service to capture those unknown users attempts easier.
👍 1
r
Richard Faulkner
06/05/2025, 1:22 PMIn NetScaler Console Service an event is triggered every time there is a failed login attempt. I believe it shows in SNMP traps as well. The Console event shows the failed attempt, the username that was attempted, and the source IP address of the client used. Can you use any of those?