CitrixDaas

Details

ID	`CitrixDaas`
Provider	Cloud Software Group
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Citrix DaaS simplifies the delivery and management of Citrix technologies.

Configure Citrix DaaS in Cortex

Parameter	Description	Required
Server URL		True
Client Id		True
Client Secret		True
Customer ID		True
Site Name		False
Max events per fetch	The maximum amount of events to retrieve. This requires the configuration logging database to be configured and enabled. Results are returned in the order of most-recent to least-recent.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Configuration steps

Prerequisites

Get Access to Citrix Cloud

Sign up for a free Citrix Cloud account, or log in to Citrix Cloud.

Citrix Cloud API Access with Service Principals
To create and set up a service principal:

Open the Citrix Cloud console and click the menu icon in the upper-left corner.
Select Identity and Access Management > API Access > Service principals > Create service principal and follow the steps to complete the setup.
If these options do not appear, you may not have sufficient permissions to manage service principals. Contact your administrator to get the required full access permission.

ServicePrincipals

Add the credentials to your secret management tool as the secret is only displayed once.
Get the Customer ID (a required parameter for the Citrix-CustomerId header).
a. Log in to the Citrix Cloud.
b. From the menu, select Identity and Access Management.
c. Click the API Access tab. You can see the customer ID in the description above the Create Client button.

Locate your tenant’s Citrix Cloud ID

Log in to https://citrix.cloud.com
If you have access to multiple tenants, select the relevant one from the list of tenant names and Citrix Cloud IDs and sign in to it.
The tenant’s Citrix Cloud ID (for example, ctxtsnaxa) is displayed at the top right corner of the screen.

LoginScreen

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

citrix-daas-get-events

Extracts Citrix configuration log events. Use with caution during development or debugging; this command may trigger event duplication or exceed API request limits.

Base Command

citrix-daas-get-events

Input

Argument Name	Description	Required
should_push_events	Set to True to create events; otherwise, the command only displays the events. Possible values are: true, false. Default is false.	Required
limit	The maximum number of logs to return. Default is 10.	Optional
search_date_option	Time filters for search operations.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
client_id — Client Id (required)
credentials — (required)
customer_id — Customer ID (required)
site_name — Site Name
max_fetch — Max events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

citrix-daas-get-events
Extracts Citrix configuration log events. Use with caution during development or debugging; this command may trigger event duplication or exceed API request limits.

Source

CitrixDaasEventCollector.py CitrixDaasEventCollector_test.py CitrixDaasEventCollector.yml CitrixDaasEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Cloud Software Group
sectionorder:
- Connect
- Collect
commonfields:
  id: CitrixDaas
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  defaultvalue: 'https://api.cloud.com'
  section: Connect
- display: Client Id
  name: client_id
  required: true
  type: 0
  section: Connect
- displaypassword: Client Secret
  hiddenusername: true
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Customer ID
  name: customer_id
  required: true
  type: 0
  section: Connect
- display: Site Name
  name: site_name
  type: 0
  section: Connect
- display: Max events per fetch
  additionalinfo: 'Maximum number of configuration log events per fetch. Requires the configuration log database to be set up and enabled. Results are returned from newest to oldest.'
  defaultvalue: '10000'
  name: max_fetch
  section: Collect
  type: 0
  required: false
- display: Trust any certificate (not secure)
  section: Connect
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  section: Connect
  name: proxy
  type: 8
  required: false
description: Citrix DaaS simplifies the delivery and management of Citrix technologies.
display: Citrix DaaS
name: CitrixDaas
script:
  commands:
  - name: citrix-daas-get-events
    description: |-
      Extracts Citrix configuration log events. Use with caution during development or debugging; this command may trigger event duplication or exceed API request limits.
    arguments:
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'false'
      description: Set to True to create events; otherwise, the command only displays the events.
      predefined:
      - 'true'
      - 'false'
      required: true
    - name: limit
      description: The maximum number of logs to return.
      defaultValue: 10
    - name: days
      description: Number of days of history to retrieve.
    - name: search_date_option
      auto: PREDEFINED
      description: Time filters for search operations.
      predefined:
      - 'LastMinute'
      - 'Last5Minutes'
      - 'Last30Minutes'
      - 'LastHour'
      - 'Last12Hours'
      - 'Last24Hours'
      - 'Today'
      - 'Yesterday'
      - 'Last7Days'
      - 'Last28Days'
      - 'LastMonth'
      - 'LastThreeMonths'
      - 'LastSixMonths'
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
  isfetchevents: true
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
supportedModules:
- xsiam