// sigma convert -t kusto --without-pipeline. NOT run against a live tenant. Replace the 192.0.2.10 placeholder.
// ===== net_firewall_netscaler_console_public_source.yml (--without-pipeline)
dst_ip =~ "192.0.2.10" and (not((ipv4_is_in_range(src_ip, "10.0.0.0/8") or ipv4_is_in_range(src_ip, "172.16.0.0/12") or ipv4_is_in_range(src_ip, "192.168.0.0/16") or ipv4_is_in_range(src_ip, "127.0.0.0/8") or ipv4_is_in_range(src_ip, "169.254.0.0/16"))))

// ===== netscaler_adc_command_from_console.yml (--without-pipeline)
"CMD_EXECUTED" and "Remote_ip 192.0.2.10"

// ===== netscaler_console_deviceconfig_command.yml (--without-pipeline)
"DEVICECONFIG" and "CMD_EXECUTED"

// ===== netscaler_console_password_recovered_default.yml (--without-pipeline)
"user recovered to default credentials"

// ===== win_net_netscaler_console_connection.yml (--without-pipeline)
DestinationIp =~ "192.0.2.10"

