NetScaler® Console service

File integrity monitoring

January 30, 2026

Contributed by:

File integrity monitoring enables you to identify if any changes or additions have been made to your NetScaler file system. This feature assesses the integrity of NetScaler files by comparing the binary hash value of your current NetScaler build with the original binary hash linked to the same NetScaler build.

The File Integrity Monitoring section in the Security Advisory dashboard lists the following:

Number of issues detected
Number of NetScaler instances impacted
Date when the last scan was run
Impacted NetScaler instances categorized under Critical, High, Medium, and Low severity
Impacted NetScaler instances that have reported issues using binary signing and verification

File integrity monitoring section

As an administrator, you can allow NetScaler to run the system scans that are scheduled periodically or you can choose to run on-demand scans based on your need.

System scan - Scans all managed instances by default. NetScaler Console decides the date and time of system scans and are disabled by default.
On-demand scan - You can trigger the scan manually when required. To run the on-demand scan, click Scan now on the security advisory dashboard.

You can click the File Integrity Monitoring section to view detailed information.

Console-Detected

The Console-Detected tab lists the impacted NetScaler instances by comparing the binary hash of the current build with the original build hash to detect modified or newly added files. The table displays the following details:

IP address - The IP address of the impacted instances.
Existing file modified -The list of the existing files that are modified.
New files added - The list of new files added.
Scan time - The time of the last scan.
Host name - The host name of the impacted NetScaler.
Modal - The modal name of the impacted NetScaler.

Click the numbers under Existing files modified and New files added to view details.

File integrity monitoring section

You can create a custom allow list and exclude specific files from file integrity monitoring scans. By defining which files to exclude from the scan, you can streamline monitoring and reduce unnecessary alerts for trusted files.

To exclude specific files from file integrity monitoring scans:

Click Exclude Files/Directories.
Select the required files or directories.

or

click Add Files/Directories to add new files. You can add standard shell glob patterns and exclude any paths that correspond to the defined criteria. When a directory is added, all its files are excluded from the scan. Click Add.

You can also perform a search to locate particular files or folders. You can also find the exclude list paths by entering a part of a file or folder in the search bar under the path option. The search functionality makes managing and reviewing excluded paths easier.

If you do not want to exclude the files from scan, you can select the required files or directories and click Remove Files/Directories. The specified files or directories are included in the next scheduled scan.

Exclude files from the scan

Points to note

Instances supported for File Integrity Monitoring: MPX, VPX instances, and Gateway.
The following scan is available for File Integrity Monitoring:
- File Integrity Monitoring scan: This scan needs the NetScaler Console to connect with the managed NetScaler instance. NetScaler Console does a comparison of the hash values by running a script in NetScaler and collecting the current binary hash values for the NetScaler system files. After the comparison, NetScaler Console provides the result with total number of existing files modified and total number of newly added files. As an administrator, you can contact your organization digital forensics for further investigations on the scan results.
The following is the list of unsupported platforms: BLX

Device-Reported

The Device-Reported tab lists the NetScaler instances that have reported issues using binary signing and verification. With this verification, each file’s digital signature is validated to confirm authenticity and detect tampering. If you see any affected instances, you can proceed with your organization’s digital forensic activities. The table lists the impacted NetScaler instances along with other details such as the host name, added binary, modified binary. You can click Details corresponding to the required instance to view detailed information.

File integrity monitoring section

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

File integrity monitoring

January 30, 2026

Contributed by:

January 30, 2026

Contributed by:

File integrity monitoring

Console-Detected

Points to note

Device-Reported

In this article