When a syslog server was added to the NetScaler, the ns.log stopped getting Alerts Severity Messages; only informational messages were displayed.
To resolve this issue enable CEF Logging on NetScaler:
On the NetScaler GUI navigate to Security.
Click Application Firewall node.
Select Change Engine Settings.
Enable CEF Logging.
This will generate "ALERT" messages on the nslog/syslog and rules can be deployed from the Application Firewall logs viewer.