Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

NetScaler advanced analytics

April 24, 2024
Contributed by: 
C

NetScaler advanced analytics examines the data gathered by NetScaler and extracts valuable insights about its performance. By leveraging the power of advanced analytics, the administrators gain insights into the network’s performance and can take proactive measures to enhance overall network reliability, performance, and security.

Analytics typically involves examining historical data to gain insights into past events and behavior. Advanced analytics uses more sophisticated techniques to gain insights into past events and also forecast future trends and potential outcomes.

Advantages of NetScaler advanced analytics

NetScaler advanced analytics provide you the following benefits:

  • Early identification of abnormal network behavior
  • Improved security posture
  • Optimized resource allocation
  • Deeper understanding of application-level traffic patterns

NetScaler advanced analytics on Splunk

NetScaler advanced analytics collects and analyzes network traffic data using third-party observation tools, such as Splunk. NetScaler advanced analytics aims at developing a robust system capable of continuously monitoring network traffic, analyzing transactions at the application layer, and flagging instances where transaction bytes surpass predefined thresholds (upload and download transaction bytes).

NetScaler adopts anomaly detection techniques that include statistical methods to identify any abnormal behavior. These techniques utilize the past 21 days’ data to establish a reliable baseline for what is considered normal behavior. NetScaler keeps a close eye on incoming traffic, in real-time. It employs advanced algorithms to define thresholds for normal transactions. These thresholds are dynamic, which means they are adjusted continuously based on the historical data and domain knowledge. Whenever a transaction exceeds the predefined threshold, the system immediately flags it for further investigation.

When anomalies are detected, the NetScaler notifies administrators to investigate and take action. This notification ensures that any potentially fraudulent or suspicious activity is identified and dealt with promptly, allowing a safer and more secure environment for all users. You can notify using email or any of the notification options that Splunk supports. To know more about notification options, see Configure alert actions.

Configure NetScaler advanced analytics on Splunk

To configure NetScaler advanced analytics app on Splunk, perform the following steps:

Prerequisites

  • Ensure that NetScaler is exporting the metrics and transactions data to Splunk.

    • Transaction data: For information on how to configure exporting data from NetScaler to Splunk, see Export transaction logs directly from NetScaler to Splunk. Along with this configuration, you must enable the following arguments to export UserAgent and URL variables in the analytics profile:

       -httpURL ENABLED -httpUserAgent ENABLED
 <!--NeedCopy-->

      Sample command

       set analytics profile <http analytics profile name> -collectors <splunk hec endpoint service name> -type webinsight -httpURL ENABLED -httpUserAgent ENABLED -httpContentType ENABLED -analyticsAuthToken "Splunk <HEC_TOKEN HERE>" -analyticsEndpointUrl "/services/collector/event" -analyticsEndpointContentType "application/json"
 <!--NeedCopy-->

      Enable export of Useragent and URL in existing analytics profile :

       set analytics profile  <http analytics profile name> --httpClientSideMeasurements ENABLED -httpURL ENABLED -httpUserAgent ENABLED
 <!--NeedCopy-->

    • Metrics: For information on how to export metrics directly from NetScaler to Splunk, see Export metrics directly from NetScaler to Splunk.

  • Ensure that the Python for Scientific computing app is installed on Splunk. To install this app, navigate to Apps > Manage Apps, click Browse for more apps, search for the Python for Scientific computing app and click Install.

  • Download the .spl file from https://www.citrix.com/downloads/citrix-adc/splunk-apps/list-of-apps.html.

  • Ensure that an index that can store 21 days of data exists on Splunk. You can use an existing index or create a new index of type Events. For information on how to create an index, see Splunk documentation.

Configuration

  1. Log in to Splunk.
  2. Navigate to Apps > Manage Apps and click Install from file.

  3. Click Choose file and upload the .spl file.

    Install app from file

  4. Click Upload and then click Continue to App setup page.
  5. On the NetScaler Advanced Analytics App for Splunk configuration page, enter data in the following fields:
    1. Enter the name of the index into which NetScaler events are ingested: The index where the data from NetScaler is stored.
    2. Enter the name of the index to save results generated from NetScaler Advanced Analytics app: The index where the data generated from the Splunk app is saved. The index must store a minimum of 21 days of data.

    advanced analytics config index

  6. Click Finish App Setup.

  7. Once the upload is complete, navigate to Apps and click NetScaler advanced analytics.

Note:

It takes a minimum of 20 days for the apps to start forecasting the anomalies.

NetScaler advanced analytics dashboards on Splunk

NetScaler advanced analytics insights consist of several dashboards that provide data on various use cases.

Unusually large download transactions

You can use the Unusually large download transactions dashboard to analyze the transactions that have unusually high data downloaded from the applications.

Example: If an attacker manages to break into an application and attempts to download a large database containing sensitive information, then this scenario is captured as an anomaly in the Unusually large download transactions dashboard. Using the dashboard you can get the details of the transaction, such as client IP address, event time, request URL, and user agent.

You can filter the data based on the following categories:

  • Time
  • NetScaler IP address
  • Application name

For a selected time frame, the dashboard displays the top client IP addresses, top UserAgents, and the top URL with anomalies. You can drill down further on the anomaly by filtering the data based on the NetScaler IP address and application name.

Unusually large download transactions

For a selected NetScaler IP address and application name, a graph is displayed that shows all transactions including the ones with high download size. The graph contains the details of downloaded bytes, maximum predicted downloaded bytes, and the anomalies.

Unusually large download transaction graph

You can export the data to PDF, clone the dashboard, and set the dashboard as the home dashboard.

Unusually large upload transactions

You can use the Unusually large upload transactions dashboard to analyze the transactions that have unusually high data upload to the application.

Example: If an attacker manages to break into an application and attempts to upload huge files hoping to exhaust storage, then this scenario is reported as an anomaly in the Unusually large upload transactions dashboard. Using this dashboard you can get the details of the anomalous transaction, such as client IP address, event time, request URL, and user agent.

You can filter the data based on the following categories:

  • Time
  • NetScaler IP address
  • Application name

For a selected time frame, the dashboard displays the top client IP addresses, top User agents, and the top URL with anomalies. You can drill down further on the anomaly by filtering the data based on NetScaler IP address and application name.

For a selected NetScaler IP address and application name, a graph is displayed that shows all transactions including the ones with high upload size. The graph contains the details of uploaded bytes, maximum predicted uploaded bytes, and the anomalies.

You can export the data to PDF, clone the dashboard, and set the dashboard as the home dashboard.

Traffic surge - download volume

You can use the Traffic surge - download volume dashboard to analyze abnormal scenarios of data download from the application through bots. The dashboard highlights if there is an unusual increase in the download rate.

Example: If a user or a bot attempts to download a high volume of data quicker than the usual download rate, then this scenario is considered as a traffic surge and reported as an anomaly. Consider that the average download data per day is 500 MB and if a bot tries to download 2 GB data, then this scenario is considered as unusually high download data volume.

You can filter the data based on the following categories:

  • Time
  • NetScaler IP address
  • Application name

For a selected time frame, the dashboard displays the list of NetScaler IP addresses and application names that have reported anomalies. You can drill down further on the anomaly by filtering the data based on the NetScaler IP address and application name.

Traffic surge - download volume

For a selected NetScaler IP address and application name, a graph is displayed that shows the data download, maximum predicted data download, and the anomalies.

You can export the data to PDF, clone the dashboard, and set the dashboard as the home dashboard.

Traffic surge - request rate

You can use the Traffic surge - request rate dashboard to analyze the unusual request rates received by an application. You can control the incoming and outgoing traffic from or to an application. A bot attack can perform an unusual high request rate.

Example: If you configure an application to allow 100 requests per minute and if you observe 350 requests per minute, then this scenario is considered as a possible bot attack and reported as an anomaly.

You can filter the data based on the following categories:

  • Time
  • NetScaler IP address
  • Application name

You can drill down further on the anomaly by filtering the data based on the NetScaler IP address and application name.

For a selected NetScaler IP address and application name, a graph is displayed that shows the request rate, maximum predicted request rate, and the anomalies.

You can export the data to PDF, clone the dashboard, and set the dashboard as the home dashboard.

Traffic surge - request rate

NetScaler advanced analytics
April 24, 2024
Contributed by: 
C
April 24, 2024
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.