Self-service search for Authentication

Use the self-service search to get insights into the user authentication details of the Citrix Cloud users in your enterprise. Citrix Analytics for Security receives the user authentication events from the Identity and Access Management service of Citrix Cloud. Authentication events such as user login, user logoff, and client update are displayed on the self-service search page.

For more information on the search functionalities, see Self-service search.

Select the Authentication data source

To view the authentication events, in the search box, select Authentication from the list. Select the time period for which you want to view the events and then click Search.

Authentication selection

By default, the self-service page displays the events for the last one month. The page also provides you with several facets and a search box to filter and focus on the required events.

Authentication page

Select the facets to filter events

Use the following filter for the authentication events:

  • Event Type- Search events based on the user event types such as user login, user logoff, and client update.

Authentication filters

For example, you want to view the events based on the user login event type for the last one month. Select User Login in the Event Type filter and the preset time 1H. Click Search to view the corresponding events.

Sample authentication

Specify search query to filter events

Place your cursor in the search box to view the list of dimensions for the authentication events. Use the dimensions to specify your query and search for the required events.

Authentication dimensions

You can also use the operators in your search query to expand your search criteria and get the required result.

For example, you want to view the authentication events for a client “nina-test” with the email status verified.

  1. Enter “client” in the search box to get the related dimensions.

    Authentication query 1

  2. Select Client-Name and then specify the value “nina-test” using the equal operator.

    Authentication query 2

    Authentication query 3

  3. Select the AND operator and then select the Email-Verified dimension. Assign the value “true” to Email-Verified using the equal operator. The “true” value indicates that the user’s email is verified.

    Authentication query 4

  4. Select the time period and click Search to view the events on the DATA table.

Self-service search for Authentication