Endpoint Security Policy activation & threat detection reporting in Monitor
Citrix Workspace App is introducing built-in security checks that will automatically detect high-risk conditions, such as Microsoft Recall enabled on endpoints without the need for any manual configuration. This real-time visibility of such detections will be available in Citrix Monitor and Monitor. The reporting will enable the administrators to quickly assess the risk and configure their protection policies to ensure a safer environment. While detection for select events like Recall is automatic, protection from events requires manual configuration of app protection policies by the admin. Activation events for all enabled policies will also be reported in Monitor and Monitor. By utilizing proactive risk management and policy reconfiguration, Admins will be able to strengthen endpoint security in their environment and reduce exposure to emerging threats.
What is Endpoint Security Reporting?
Endpoint Security reporting gives admins visibility into endpoint threats and the effectiveness of their app protection policies. Endpoints running Windows Recall (Microsoft’s AI screen-monitoring agent that could capture VDI session content) are automatically detected and reported, with no policy configuration required. Policy activations for configured protection policies (anti screen capture, anti DLL injection, and so forth) are also logged and reported with a detailed audit trail. Policy activation reporting provides the necessary evidence for admins to validate the effectiveness of their configurations and satisfy compliance audits.
The following reporting will be available in Monitor:
-
Audit Trail
-
Automatic Detection – During its default scan, CWA detects various threats like Windows Recall on the endpoint. If a threat is detected, CWA will send an event to Monitor. The following data will be reported for each event –
- Timestamp
- Username
- Endpoint name
- Endpoint OS
- CWA version
- Event name
- Event type – Detection or protection
-
-
Protection for configured policies – Administrators can configure protection policies to prevent certain events such as Screen capture, DLL injection, or Keylogging. Anti screen capture policy can be used to prevent screen capture attempts by recall as well. Protection events reported in Monitor will include all the data points listed above.
-
Aggregated insights and trends – Events data will be aggregated to report the following information:
-
Detection/protection summary for the environment,
-
Top protected/detected events, and
-
Trend of protection and detections events over time
-
This capability is designed to further strengthen Citrix’s commitment to securely deliver applications by helping organizations identify emerging threats and respond to them in real time.
Administrators can use the above insights to better understand the security “threats” in their environment and setup protection policies to protect sensitive data, minimize security risk, and support the establishment of related corporate level policies designed to mitigate such risk. (e.g. discourage the use of tools like recall, keylogger, etc.)
I am not seeing any data on this page, why is that?
If you are not seeing any data, it can be due to one of the following three scenarios:
- Version dependency (missing telemetry) - Endpoint security telemetry has a dependency on CWA and VDA versions. VDA version 2507 and above is required to capture the required telemetry, and CWA version 2603 and above is required to send the telemetry to Monitor. In this scenario, policy activations or Recall detection might still happen, but no data is displayed in Monitor if either of the previous requirements is not met. Therefore, admins should ensure that the VDAs where protection policies are configured are running version 2507 or above, and that the client used to access these VDAs is version 2603 or above.
- Protection policy not configured (no data to show) - If the VDA and CWA are running the required versions, the endpoint security page might still not show any data if protection policies are not configured. Policy configuration is a prerequisite for policy activation. Detection of the Recall AI agent is automatic and does not require any policy configuration. In this scenario, it means that none of the endpoints running CWA version 2603 and above have Recall enabled.
- No policy activations (no data to show) - If the admin has configured protection policies, the endpoint security page might still not show any data if the policy triggering conditions do not occur. For example, a user did not attempt any screen capture within their session after the anti-screen capture policy was configured.