NSC-Service. Anyone knows why the IoC Scan is alwa...
# citrix-netscaler
j
NSC-Service. Anyone knows why the IoC Scan is always Skipped? I can choose my instances and run the Scan, it says OK, if I check the Scan history, it's scheduled for about 10 seconds, when I hit refresh, it's gone. No errors or sth. Telemetry is enabled and fine?!
m
SAME! And it's driving me nuts! I did get a report back today and we're suspecting what was reported came from Rapid7 scanning our AAUTH instances.
Running the scan again doesn't yield any new reports and appears to skip again. So I'm wondering, if the IoC script doesn't find anything, do it skip instead of say "nothing detected?"
r
For me if i choose just one that runs and the rest of course say skipped becasue for that scan they were skipped. But I assume your checking them all and running the scan.
j
Tried both, only some instances, or all, it looks like it never scans, but I don't know why. Onprem it looks different and I get some informations here. In NSC-Service here, I would say there is an issue or anything happening which stops the Scan to start
m
Same for me. Running more than 1 or just 1, I get skipped every time with 1 exception. And the exception had hits to report on.
r
@Julian Jakob I don't see a script version in the screenshot. Maybe the console didn't get the script yet? Can you see ioc update in system messages?
j
Only this here. Is there another one which says some kind of "Succesful download of IoC Script" or sth like that?
r
good call mine shows the scipt version as 27-sep-2026
j
OnPrem NSC, too. In Cloud, checked three tenants, Script Version NA and Scan doesn't work
r
Tried rebooting ns console yet?
j
Can't reboot NSC-Service, it's cloud. OnPrem everything is fine. But these damn NSC-Service instances are not working fine.
r
And which version are you running of console?
Oh sorry 😅
r
Do you have console advisory connect enabled on the NetScaler instances
a
Are any of you with the skipped IOC scan also finding manual CVE scans never complete? Am guessing a bug or restriction with manually initiated scans on the instances? Have the IOC skip and this at three clients which I noted are all just using the built in NetScaler agents.
m
I have the same exact problem as you do with the CVE scan. At first I thought that was my screenshot.
c
I think IOC Scans won't work with the built-in Agent All this Nodes are skipped in Console
j
That could be possible, Christian. I'm But only via NSC-Service. OnPrem it's working fine, also with built-in Agent
c
We're working with NSC-Service We opened a ticket to get some clarity.
j
Any confirmation from Support if it's only working fine with an Agent? I tried to create a config job and run the V4 script via Config-Job. File-Upload with SCP and the running of the script works fine, but no chance to get the results.txt via SCP form NS to NSC-Service back. Upload fails - I think maybe because of the same thing, the inbuilt-agent doesn't support SCP File-Uploads back to NSC-Service