Citrix Analytics for Security

Self-service search for Authentication

Use the self-service search to get insights into the user authentication details of the Citrix Cloud users in your enterprise. Citrix Analytics for Security receives the user authentication events from the Identity and Access Management service of Citrix Cloud. Authentication events such as user login, user logoff, and client update are displayed on the self-service search page.

For more information on the search functionalities, see Self-service search.

Select the Authentication data source

To view the authentication events, in the search box, select Authentication from the list. Select the time period for which you want to view the events and then click Search.

Authentication selection

By default, the self-service page displays the events for the last one month. The page also provides you with several facets and a search box to filter and focus on the required events.

Authentication page

Select the facets to filter events

Use the following filter for the authentication events:

  • Event Type- Search events based on the user event types such as user login, user logoff, and client update.

Authentication filters

The following figure shows the user login events for the last one month.

Sample authentication

Specify search query to filter events

Place your cursor in the search box to view the list of dimensions for the authentication events. Use the dimensions and the operators to specify your query and search for the required events.

Authentication dimensions

For example, you want to view the authentication events for a client “nina-test” with the email status verified.

  1. Enter “client” in the search box to get the related dimensions.

    Authentication query 1

  2. Select Client-Name and then specify the value “nina-test” using the equal operator.

    Authentication query 2

    Authentication query 3

  3. Select the AND operator and then select the Email-Verified dimension. Assign the value “true” to Email-Verified using the equal operator. The “true” value indicates that the user’s email is verified.

    Authentication query 4

  4. Select the time period and click Search to view the events on the DATA table.

Self-service search for Authentication