IoC report came in last night on a patched netscaler. Claude gave these suggestions. Is there a consensus on these suggestions, and what the real risk is if the device was already patched?

The pitboss PPE messages will also appear after the update. So there's someone trying to bash your instances, but its failing. If the timestamp is AFTER your patches, you should be fine. If it's before patching, you may be compromised.

This client is in the energy sector and has governmental reporting requirements, so as a precaution we will be running through the remediation steps and rebuild, just to be sure. But that information in the pit boss messages is helpful to ease the tensions at the moment.