Along with UberAgent Dashboards I am building in grafana, I started making some for NetScaler syslog data as well. I am right now capturing failed login attempts to farm Ips that are doing password spraying. I also have one for the Pitboss we saw with the last CVE. Are there any other specific syslog messages you have seen that could indicate an attack attempt? I am thinking curl, fetch, etc.