https://worldofeuc.com logo
Join Slack
Powered by
Anyone got any IOC tools/scripts yet from citrix o...
# citrix-netscaler
c
Anyone got any IOC tools/scripts yet from citrix our security guy is telling me there is one ?
m
it's in the netscaler console now
m
NetScaler Console now has an IoC scan tool built-in. Haven't come across the script standalone. Infrastructure --> Instance Advisory --> Security Advisory --> IoC
👍 1
r
You can open a ticket and ask for the IoC script if you have an air gapped system.
But the console is the fastest way to get it checked.
c
i got netscaler console so will check it now cheers
c
Its Only working with Full ns agent , Right ?
c
all done all netscaler checked and all good 🙂
r
It works for both Console Service and On Premises I beleive.
e
Did update console on prem to 73.36 but still cannot find it
c
I was using netscaler console in cloud to do my IOC scans
r
If you contact support you can get a IoC script
Oh! @Richard Faulkner already mentioned it
r
You have to have telemetry enabled and there is a "Security Advisory" check box that needs to be checked to get the new CVE data
image.png
d
Just ran IOC and it says the ver is from today
e
@Richard, had both done before updating and douvble checked, even restarted the On Prem Console just to be sure, still no cigars....
l
Im on the latest netscaler console, have all the new CVEs listed, and nothing related to IOCs shows up on mine either
e
Smells like not yet available on-prem... a pity
r
Interesting. I have not set it on that customer yet. Once I do, I will let you know if I am seeing the same. It is supposed to be available on Premises.
What version of NetScaler Console are you running on-premises? I wonder if it needs an upgrade as well.
e
14.1-73.36
r
😞
That is the latest.....
r
I am seeing same behavior as Eric and Brian with my on-prem NetScaler Console v14.1-73.36. I have checked the Telemetry setting and rebooted the Console VM.
r
Same
r
This makes me sad. We need to verify with support why that is as they are indicating on premises should work as well.
m
should just provide IoC just alllll the other vendors do… IPs and file changed
so we can do detection directly
j
Same here. NSC-Service it's there. OnPrem NSC not.
m
so useless…and especially with earlier cves attackers had persistent web shells
d
I'm only seeing IoC on Cloud. :-(
r
Funny thing, under system events in console: NetScaler Console security alert: Update available in Indication of Compromise (IoC) An update is available for Indication of Compromise (IoC) in the NetScaler Console. Please log in to the NetScaler Console and scan the devices for enhanced detection capabilities. So he knows 😆 but doesn't show
r
I am hearing there may be an enablement needed on the cloud side. You can open a ticket or work with your ATS if you have one to get it enabled and then it shows up.
e
That's also one possibility I have thinked about last night but I need customer to start work and be available to give me access to their cloud tenant to check and it will be after finishing this morning patching session for the few customers that did not answer during the WE ;-)
j
Anyone coded a Config-Job or sth like that to automate the IoC-Scriptfile as a Job to run on all NetScalers and check the output, as an alternative when IoC-Check isn't available on NSC 🙂
s
I ended up creating a ticket, as i saw the same thing with the onprem version of the latest console, no IOC tab. They provided the ioc script for me to run manually. I had asked them about them switching something on the backend so I could see the tab, they said they are taking this back to engineering to get me a confirmation. I'll report back when I have something
👍 1
r
The IOC tab was waiting for me this morning after I logged in to NetScaler Console. It wasn't there yesterday.
s
interesting
j
Two customers got the IoC tab this afternoon, looks like it's getting deployed differently
e
Had one customer that got the tab to appear on-prem too this afternoon others still nothing, seems to be staged deployment ;-)
f
In case it helps someone, the tab appeared for us after ticking the IoC box in Update Information, located under the cloud icon at the top right of the console
🙏 2
8 Views
Open in Slack
PreviousNext
Powered by