Web & Access

Citrix NetScaler Gateway VPN

Citrix ADC / NetScaler Gateway VPN syslog events covering the full SSL VPN session lifecycle — authentication, login/logout, ICA application launches, TCP/UDP connection statistics, HTTP resource access, client security checks, session timeouts, and license limit alerts.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/vpn-citrix-netscaler/generator.yml \
  --id vpn-citrix-netscaler \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
sslvpn-login	SSL VPN session login with client and group info	~11.1%	authentication
aaa-login-failed	Failed authentication with failure reason	~0.9%	authentication
sslvpn-logout	Session end with duration, bytes, and connection stats	~6.1%	authentication
ica-start	Citrix ICA application launch (Workspace apps)	~20.0%	network
ica-end	ICA application terminated with transfer stats	~13.3%	network
tcp-connstat	TCP connection statistics for VPN tunnel	~22.2%	network
udp-flowstat	UDP flow statistics (DNS, NTP, SNMP, etc.)	~4.4%	network
http-request	HTTP resource access through VPN	~16.7%	network
tcp-conn-timedout	VPN connection timed out	~2.8%	network
clisec-check	Client endpoint security compliance check	~1.7%	security
license-limit	VPN license limit reached alert	~0.8%	security

Realism Features

Correlated VPN sessions — login events produce session context consumed by logout with matching user/IP/session ID
Correlated ICA sessions — ICA start events produce context consumed by ICA end with matching app/UUID/user
Logout method distribution — UserLogout (55%), TimedOut (25%), AdminLogout (10%), InternalError (5%), ForceLogout (5%)
Session duration distribution — short, medium, long, workday, and extended durations
Authentication failure scenarios — 70% real users with typos, 30% attacker-style usernames
Client security checks with endpoint compliance expressions (AV, firewall, OS version, domain)

Sample Output

{
  "@timestamp": "2026-03-06T10:15:22.000000+00:00",
  "event": {
    "action": "logged-in",
    "category": [
      "authentication",
      "session"
    ],
    "dataset": "citrix_adc.log",
    "kind": "event",
    "module": "citrix_adc",
    "outcome": "success",
    "type": [
      "start",
      "allowed"
    ]
  },
  "citrix": {
    "device_product": "NetScaler",
    "device_vendor": "Citrix",
    "hostname": "NSGW-01",
    "name": "SSLVPN LOGIN",
    "session_id": "3847291"
  },
  "citrix_adc": {
    "log": {
      "browser_type": "Citrix Workspace 24.3.0.36",
      "client_ip": "198.51.100.42",
      "group": "VPN_Users",
      "session_id": "3847291",
      "sslvpn_client_type": "ICA",
      "user": "jsmith",
      "vserver": {
        "ip": "10.200.1.10",
        "port": 443
      }
    }
  },
  "observer": {
    "product": "Netscaler",
    "type": "firewall",
    "vendor": "Citrix"
  },
  "user": {
    "name": "jsmith",
    "domain": "corp.example.com"
  }
}

Parameters

Parameter	Default	Description
hostname	NSGW-01	NetScaler Gateway hostname
domain	corp.example.com	Domain for FQDN and user domain
vserver_ip	10.200.1.10	VPN virtual server IP
nat_ip	203.0.113.50	NAT/mapped IP address
agent_id	c3d4e5f6-...	Filebeat agent ID
agent_version	8.17.0	Filebeat version

Related Generators

Web & Access

Nginx Access & Error Logs

Nginx reverse proxy and web server — access logs with upstream timing, error logs with module context, bot/crawler traffic, scanner probes, and correlated 4xx/5xx error entries.

Web & Access

Apache HTTP Server

Apache httpd access and error logs — page/asset/API requests, bot crawlers (Googlebot, GPTBot), scanner probes, 3xx redirects, and correlated 4xx/5xx error log entries with module context.

Web & Access

Cisco AnyConnect VPN

Cisco ASA AnyConnect SSL VPN — session lifecycle from RADIUS authentication through tunnel establishment, IP assignment, DAP policy evaluation, session roaming between gateways, to graceful disconnection.