NetScaler WAF Solution for Sentinel

Solution: Citrix Web App Firewall

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Attribute	Value
Publisher	Citrix Systems
Support Tier	Partner
Support Link	https://www.citrix.com/support/
Categories	domains
Version	3.0.2
Author	Citrix Systems
First Published	2022-05-06
Last Updated	2026-02-09
Solution Folder	Citrix Web App Firewall
Marketplace	Azure Marketplace · Popularity: 🟡 Low (47%)
Pre-requisites	Common Event Format

Citrix Web App Firewall (WAF) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel to enable you to take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on Aug 31, 2024.

Pre-requisites
Data Connectors
Tables Used
Content Items

Pre-requisites

This solution depends on 1 other solution(s):

Solution
Common Event Format

Data Connectors

This solution has 2 discovered data connector(s)⚠️ (not in Solution definition):

Connectors from dependency solutions:

Common Event Format (CEF) (dependency on Common Event Format)
Common Event Format (CEF) via AMA (dependency on Common Event Format)

🔍 Discovered: This item was discovered by scanning the solution folder but is not listed in the Solution JSON file.

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`CommonSecurityLog`	Common Event Format (CEF) (dependency), Common Event Format (CEF) via AMA (dependency), [Deprecated] Citrix WAF (Web App Firewall) via AMA, [Deprecated] Citrix WAF (Web App Firewall) via Legacy Agent	Workbooks

Content Items

This solution includes 1 content item(s):

Content Type	Count
Workbooks	1

Workbooks

Name	Tables Used
CitrixWAF	`CommonSecurityLog`

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.2	29-11-2024	Removed Deprecated Data Connectors
3.0.1	10-07-2024	Deprecating data connectors.
3.0.0	08-09-2023	Addition of new Citrix Web App Firewall AMA Data Connector