Web Session ASIM parser for Citrix NetScaler(Web App Firewall)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimWebSessionCitrixNetScaler |
| Built-in Parser | _ASim_WebSession_CitrixNetScaler |
| Schema | WebSession |
| Schema Version | 0.2.6 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Citrix NetScaler |
| Parser Version | 0.1.1 (version history) |
| Last Updated | Jun 26, 2025 |
| Unifying Parser | ASimWebSession |
| Source File | Parsers\ASimWebSession\Parsers\ASimWebSessionCitrixNetScaler.yaml |
Description
This ASIM parser supports normalizing Citrix NetScaler WAF(Web Application Firewall) logs to the ASIM Web Session normalized schema. Citrix NetScaler WAF(Web Application Firewall) events are captured through Citrix WAF (Web App Firewall) data connector which ingests web attack logs into Microsoft Sentinel in CEF format via Syslog.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID == "APPFW"DeviceProduct == "NetScaler"DeviceVendor == "Citrix" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, VirtualMetric DataStream
References
- ASIM Web Session Schema
- ASIM
- [Citrix NetScaler WAF Documentation](https://support.citrix.com/article/CTX136146/common-event-format-cef-logging-support-in-the-application-firewall https://docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/logs https://docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/xml-protections/xml-cross-site-scripting-check)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊