Citrix SPA Sentinel App
بواسطة Citrix
Citrix Security Private Access and Device posture Events export for SOC admins
Citrix Secure Private Access offers Adaptive Authentication, single sign-on support, enhanced security controls for the applications. Secure Private Access also provides the capabilities to scan the end user device before establishing a session by using the Device Posture service. Based on the Adaptive Authentication or Device Posture results, admins can define the authentication methods for the apps.
The integration of Secure Private Access with Security Information and Event Management (SIEM) enables administrators to export critical logs, policy outcomes, and user activity data to third-party SIEM systems using Kafka push mechanisms. This integration provides enhanced visibility, compliance tracking, and security insights for organizations using Citrix Secure Private Access services.
This integration also enables SOC admins to identify and proactively remediate security risks. It improves time to value and enables faster detection as admins are able to easily aggregate events from disparate data sources and ways to export data. SOC Threat hunters can also further leverage all Citrix data and CAS dashboards for search, risk analysis and correlation across wider IT Infrastructure.
This application can be used with entitlements of Citrix Secure Private Access available with Citrix Platform and Universal Hybrid Multi-Cloud offering.
https://www.citrix.com/buy/licensing/product.html
File path - https://github.com/Azure/Azure-Sentinel/tree/9774a1841be754c03a978d26ad48da9745c2059a/Solutions/Citrix%20Analytics%20CCF
Release notes
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Citrix%20Analytics%20CCF/ReleaseNotes.md
Content included:
CCF solution includes Data Connector :1 and Workbooks: 1, no Parsers, Analytic Rules and Hunting Queries
Prerequisites
To integrate with Citrix SPA application for Sentinel (via Codeless Connector Framework) make sure you have:
- Workspace: read and write permissions are required.
- Keys: read permissions to shared keys for the workspace are required. See the documentation to learn more about workspace keys.
- Microsoft Entra: Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
- Microsoft Azure: Permission to assign Monitoring Metrics Publisher role on data collection rules. Typically requires Azure RBAC Owner or User Access Administrator role.
- Licensing: Entitlements to Citrix Analytics in Citrix Cloud. Please review Citrix Tool License Agreement.