Purpose
This guide explains how to configure the Citrix ADC (formerly NetScaler ADC) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, list traffic domains, list configured ACLs, and add or delete a blocking ACL entry on Citrix ADC. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
Prerequisites
- A Citrix ADC appliance with its management/NITRO API reachable from the Logsign server.
- An ADC account with permission to read and modify ACLs.
- Use least privilege. Create a dedicated ADC command-policy-restricted account for this integration if your ADC deployment supports scoped command policies, rather than a full superuser account.
Step 1: Prepare Citrix ADC for API Access
- Log in to the Citrix ADC management console (or CLI) with an administrator account.
- Create (or designate) a dedicated user account for Logsign to use, with permission to view and manage ACLs.
- Note the ADC's management hostname/IP, the port and protocol used to reach it, and the username/password for the account.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Citrix ADC, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Citrix ADC device in Logsign. |
| Host | Yes | Hostname or IP address of your Citrix ADC. |
| Port | Yes | Management port (typically 443 for HTTPS). |
| Protocol | Yes | Typically https. |
| Username | Yes | The ADC account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
| Insecure Skip Verify | No | Disables TLS certificate validation on Logsign's outbound calls to the ADC when enabled. Leave off unless you have a specific reason to keep it on. |
Click Create to save the device.
Available Methods
- get_traffic_domains (Analysis) — lists configured traffic domains on the ADC.
- get_acl_list (Analysis) — lists currently configured ACLs.
- add_acl (Containment) — creates a new blocking ACL entry. Typical fields: IP address, port, protocol, and a TTL/expiry for the entry.
- delete_acl (Recovery) — removes an existing ACL entry.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password. | Re-enter the Username and Password fields and confirm the account can log in to the ADC directly. |
| 403 Forbidden | The account's command policy does not permit ACL read/write. | Confirm the account's assigned command policy in ADC includes ACL management. |
| add_acl succeeds but traffic is not actually blocked | The new ACL was not applied/committed, or a higher-priority ACL/policy takes precedence. | Confirm the ACL is active (use get_acl_list to verify) and review ACL priority/ordering on the ADC. |
Notes and Limits
- ACL entries added by this integration are standard ADC ACLs; how long a block persists depends on the TTL/expiry you configure in add_acl and on the ADC's own ACL behavior, not on any automatic scheduling inside Logsign.
- The exact ADC console/CLI steps for creating a scoped API account were not independently verified against a live appliance during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.