File integrity monitoring

Last published : Sep 21, 2026
File integrity monitoring enables you to identify if any changes or additions have been made to your NetScaler file system. This feature assesses the integrity of NetScaler files by comparing the binary hash value of your current NetScaler build with the original binary hash linked to the same NetScaler build.
The File Integrity Monitoring section in the Security Advisory dashboard lists the following:
  • Number of issues detected
  • Number of NetScaler instances impacted
  • Date when the last scan was run
  • Impacted NetScaler instances categorized under Critical, High, Medium, and Low severity
  • Impacted NetScaler instances that have reported issues using binary signing and verification
File integrity monitoring section
As an administrator, you can allow NetScaler to run the system scans that are scheduled periodically or you can choose to run on-demand scans based on your need.
  • System scan - Scans all managed instances by default. NetScaler Console decides the date and time of system scans and are disabled by default.
  • On-demand scan - You can trigger the scan manually when required. To run the on-demand scan, click Scan now on the security advisory dashboard.
You can click the File Integrity Monitoring section to view detailed information.
Related information

Console-Detected

The Console-Detected tab lists the impacted NetScaler instances by comparing the binary hash of the current build with the original build hash to detect modified or newly added files. The table displays the following details:
  • IP address - The IP address of the impacted instances.
  • Scan status - Displays scan error results.
  • Existing file modified -The list of the existing files that are modified.
  • New files added - The list of new files added.
  • Scan time - The time of the last scan.
  • Host name - The host name of the impacted NetScaler.
  • Modal - The modal name of the impacted NetScaler.
Scan error results are displayed within the main dashboard view so that you need not click the individual scan results or line items to access error details. Any integrity issues, such as hash mismatches or scan errors, are presented in a clear, accessible format on the dashboard helping you identify and understand problems quickly.
Click the numbers under Existing files modified and New files added to view details.
File integrity monitoring section
You can create a custom allow list and exclude specific files from file integrity monitoring scans. By defining which files to exclude from the scan, you can streamline monitoring and reduce unnecessary alerts for trusted files.
To exclude specific files from file integrity monitoring scans:
  1. Click Exclude Files/Directories.
  2. Select the required files or directories.
    or
    click Add Files/Directories to add new files. You can add standard shell glob patterns and exclude any paths that correspond to the defined criteria. When a directory is added, all its files are excluded from the scan. Click Add.
    You can also perform a search to locate particular files or folders. You can also find the exclude list paths by entering a part of a file or folder in the search bar under the path option. The search functionality makes managing and reviewing excluded paths easier.
If you do not want to exclude the files from scan, you can select the required files or directories and click Remove Files/Directories. The specified files or directories are included in the next scheduled scan.
Exclude files from the scan

Points to note

  • Instances supported for File Integrity Monitoring: MPX, VPX instances, and Gateway.
  • The following scan is available for File Integrity Monitoring:
    • File Integrity Monitoring scan: This scan needs the NetScaler Console to connect with the managed NetScaler instance. NetScaler Console does a comparison of the hash values by running a script in NetScaler and collecting the current binary hash values for the NetScaler system files. After the comparison, NetScaler Console provides the result with total number of existing files modified and total number of newly added files. As an administrator, you can contact your organization digital forensics for further investigations on the scan results.
  • The following is the list of unsupported platforms: BLX

Device-Reported

The Device-Reported tab lists the NetScaler instances that have reported issues using binary signing and verification. With this verification, each file's digital signature is validated to confirm authenticity and detect tampering. If you see any affected instances, you can proceed with your organization's digital forensic activities. The table lists the impacted NetScaler instances along with other details such as the host name, added binary, modified binary. You can click Details corresponding to the required instance to view detailed information.
File integrity monitoring section