PoC Guide: POC Guide Citrix Analytics for Security
Citrix Analytics for Security continuously assesses the behavior of Citrix Virtual Apps and Desktops users and Citrix DaaS users and applies actions to protect sensitive corporate information. The aggregation and correlation of data across networks, virtualized applications and desktops, and content collaboration tools enables the generation of valuable insights and more focused actions to address user security threats. More information on Citrix Analytics for Security can be found here and videos demonstrating the Citrix Analytics for Security can be found here.
The current prerequisites for Citrix Security Analytics are:
- Delivery Controller 1912 CU2 or later
- Director 1912 CU2 or later
- Citrix Cloud account with Citrix Analytics entitlements
- If you are using StoreFront, StoreFront 1906 or later is required
For up to date requirements, visit: Citrix Security Analytics Requirements
- Subscribe to Citrix ADM service offered on Citrix Cloud. To learn how to get started with Citrix ADM service, see Getting Started.
- Review the system requirements and ensure that the requirements are met.
Log into Citrix Cloud and click Manage under the Analytics console from your StoreFront server
Click settings and then click data sources
Click the ellipses next to Virtual Apps and Desktops and select Connect to StoreFront Deployment
Click download file
Open powershell and run the following command: Import-STFCasConfiguration -Path “configuration file path”
You can see that the StoreFront database has been added
Site needs to be added to Citrix Workspace using Site Aggregation beforehand
Log into Citrix Cloud from one of your delivery controllers
Select manage under Security Analytics
Select Data sources under Settings
click Policy Incomplete under Virtual Apps and Desktops
click the drop down under your site name and then click continue
Select download agent
Complete the installation
click Connect to Installed Agent. This process can take a few minutes.
Enter the information for your site administrator
Enter your Director’s URL
Click done after reviewing your information
User risk indicators are user activities that look suspicious or can pose a security threat to your organization. User risk indicators span across all Citrix products used in your deployment. The indicators are based on user behavior and are triggered where the user’s behavior deviates from the normal. User risk indicators help in determining the user’s risk score.
Click Custom Risk Indicators and Policies under Settings
Turn on the risk indicators by clicking the toggle. Then click Create Indicator
Here you can create custom indicators
Click policies. A policy is a set of conditions that must be met to apply an action. A policy contains one or more conditions and a single action. You can create a policy with multiple conditions and one action that can be applied to a user’s account.
Click Create policy
Select the condition and then the action you want
Make sure that the policy is enabled and click Create policy
The user dashboard provides visibility into user-behavior patterns across an organization. Using this data, you can proactively monitor, detect, and flag behavior that fall outside the norm, such as phishing or ransomware attacks. click a specific user
This dashboard provides a risk timeline of what the user is doing and what source it is coming from.
click Access assurance
The Access Assurance Location dashboard provides an overview of the locations from where your users are accessing their Citrix Virtual Apps and Desktops environment.