Self-service search for Authentication
Use the self-service search to get insights into the user authentication details of the Citrix Cloud users in your enterprise. Citrix Analytics for Security receives the user authentication events from the Identity and Access Management service of Citrix Cloud. Authentication events such as user login, user logoff, and client update are displayed on the self-service search page.
For more information on the search functionalities, see Self-service search.
Select the Authentication data source
To view the authentication events, in the search box, select Authentication from the list. Select the time period for which you want to view the events and then click Search.
By default, the self-service page displays the events for the last one month. The page also provides you with several facets and a search box to filter and focus on the required events.
Select the facets to filter events
Use the following filter for the authentication events:
- Event Type- Search events based on the user event types such as user login, user logoff, and client update.
For example, you want to view the events based on the user login event type for the last one month. Select User Login in the Event Type filter and the preset time 1H. Click Search to view the corresponding events.
Specify search query to filter events
Place your cursor in the search box to view the list of dimensions for the authentication events. Use the dimensions to specify your query and search for the required events.
You can also use the operators in your search query to expand your search criteria and get the required result.
For example, you want to view the authentication events for a client “nina-test” with the email status verified.
Enter “client” in the search box to get the related dimensions.
Select Client-Name and then specify the value “nina-test” using the equal operator.
Select the AND operator and then select the Email-Verified dimension. Assign the value “true” to Email-Verified using the equal operator. The “true” value indicates that the user’s email is verified.
Select the time period and click Search to view the events on the DATA table.