Hunting Citrix NetScaler Zero-Days with Corelight: Part 2

In Hunting Citrix NetScaler Zero-Days with Corelight , we explored how network evidence from Corelight’s Open Network Detection and Response (NDR) Platform can help identify candidate NetScaler appliances, observe DTLS use and hunt for suspicious activity. This follow-up examines a clue recorded by an existing DTLS analyzer from the Zeek® Project (a non-profit project that maintains an open-source software platform which generates compact, high-fidelity transaction logs, file content, and fully customizable outputs), and shows how defenders can use it within Corelight Open NDR to investigate p