Regarding the IOC scan in Console, AHV versions are flagged as compromised but if you check the report, the time stamp on the files is Aug. We compared to a clean version and determined likely a false positive. Can stop the panic and yes bourbon.

I dont see that on my VPN on nutanix it comes up clean. Are you using the kvm vpx on nutanix or proper ahv vpx ?

Only versions converted to AHV. I have not yet checked the scanner this morning, this might be fixed because no doubt the call load was over the top.

I have a pair of converted VPX's on Nutanix that are displaying a long list of IoCs. They are not internet connected either.

IOC scanner is not currently supported on Linux and Nutanix.

🫠

I have my secops team sweating bullets over the Nutanix VPX IOC report. Is there a blurb in documentation about it? Otherwise I'll be printing out Eric’s post.

@Matt Sliva which part are they sweating bullets over?

That I run the IoC tool on the Nutanix NetScalers and it says “Potentially Compromised” and it returns a report full of IoC’s. The IoC documentation doesn't state any incompatibilities. So they assume the NetScalers are hosed. Making my life harder to fix real issues.

I got confirmation through the case owner on our ticket the IOC script given by support only applies to the BSD versions, I asked what the alternative is for Linux/Nutanix AHV builds and "they are investigating". Our on prem NS Console has the IOC option after upgrading to the latest build and it specifically states only BSD is supported by the checks.

Was it in the EULA for the IoC page? I can't seem to find the BSD wording.

No...the script provided by support included a EULA text file with just generic legalese and a link to the NetScaler Console Service IOC legal document, which is more generic legalese. Nothing about OS etc. It's short as far as EULAs go.

Was that ioc script v2? I thought mine said something about bsd vs Linux in it but I'm taking a break from my computer

V1, received yesterday

Oh ok, I got mine today so they may have added the verbiage

Did the chatbot or a human give you both the script? I need it for adaptive auth because my instance has issues and support is overwhelmed.

It was emailed to me as an attachment from a human (I think)

I submitted a ticket yesterday morning and received it just after noon, also received via email

They asked if I had patched yet and then once I confirmed that they sent the script

looks like they changed behaviour of the scan. now shows this on our Linux based Netscalers

Script has been updated, suggest trying again.

we ’ve got some security guys from US, they advised script v3 exists and should support Linux.