summer 2017 citrix corporate template - fowt · © 2018 citrix | summit 2018 | confidential...

© 2018 Citrix | Summit 2018 | Confidential – Content in this presentation is under NDA

Citrix Analytics An overview

Niek Boevink

Senior Sales Engineer Citrix

9 OKTOBER 2019


Emphasis on Machine Learning based modeling to

reduce ‘data-to-value’ barrier

Data analysis, correlation and insights across all

Citrix products

Delivered from Cloud, but supports hybrid Citrix

deployments

VALUE ACROSS CITRIX ECOSYSTEM

DELIVERED VIACITRIX CLOUD

AI / ML DRIVEN ANALYTICS

CITRIX ANALYTICS STRATEGY


TURN-KEY

Turn-key data collection

User behavior & context based

1

ACCURATE

Correlation from multiple vantage points for accuracy

Machine Learning based models

2

AUTONOMOUS

Closed-loop autonomous actions

Granular policy control

3

Citrix Analytics is Unique

Sense Analyze Respond


Citrix Analytics

Security Performance Operations

Citrix Virtual AppsCitrix Endpoint Management

CITRIX CONTENT COLLABORATION

CITRIX NETWORKING&

ACCESS CONTROL

Director | Smart CheckCitrix Application Delivery

Management | SD-WAN InsightCitrix Endpoint Management Analyzer

Users

Apps NetworksAi / ML


Networking Offerings / Access Control

Virtual Apps & Desktops

Endpoint Management

Content Collaboration

Collect Data

Generate Insights

Citrix Analytics


Endpoint Management

Networking Offerings / Access Control


Take Actions

Citrix Analytics FLOW


Security Analytics


Leading cause of security Breaches?

32%

25%

23%

20%Human Error

Phishing

Ransomware

Lost Devices

- BakerHostetlers Data Security Incident Report

• Average security events per day: 200,000 events

• Average malware alerts per week: 17,000 alerts, only 4% are investigated

• Average annual cost of false positives: $1.37 million

Source: IBM & Ponemon Institute

Why Citrix Analytics Security?


Closed-loop, autonomous system to dynamically adjust security

Citrix Analytics

Security

User Behavior Security Analytics

Application Security Analytics

Data Security Analytics

User Behavior Security Analytics


VRAAG:

Het percentage van security breaches door gecompromitteerde inloggegevens en zwakke wachtwoorden? 1 81%

1. Verizon Data Breach Investigations Report (DBIR)


DescriptiveWhat happened?

DiagnosticHow it happened?

PredictiveWhat will happen?

PrescriptiveWhat to do?

Excessive (sensitive) file downloads

Stolencredentials

Loss of(sensitive) data

QuarantineUser

Example


User Behaviors & Categories

Access

Content

Apps

Network

Notifications & Policy Control

Policy

High

Medium

Low

Proactive, Granular, Policy Control

Citrix Workspace

SaaS Apps

Mobile Apps

Networks

PartnerEcosystem

Devices

Content

Virtual Apps

ML Modeling, Profiles, & Risk Scores

Risk Meter

User behavior security analytics


Risk Scores are values that indicate the aggregate level of risk a user poses– Based on User Behavior Analytics

– Dynamic and based on patterns for specific user behaviors

Risk Indicators are user activities that look suspicious or can pose a security threat to your organization– Provided by different Citrix products

Administrators can provide feedback to report if a risk indicator is accurate

Risk Score & Risk Indicator


Access Data App Group

Risk Indicators

Endpoint Management


Gateway

Access Control

Virtual Apps & Desktop

Other…

Policy based violations

User Behavior Modeling Over

Time

Peer Group Normalization

AI/ML anomaly behavior detection

How the User Risk Score Works


Events Generate Insights

Citrix Analytics

Take Actions

Citrix Sources

• Citrix Virtual Apps & Desktops

• Content Collaboration• End point management• Networking

Microsoft Sources

• Azure AD ID Protection• Windows ATP

Risk Indicators

MicrosoftGraph Security

API

Citrix

• Citrix Virtual Apps & Desktops

• Content Collaboration• End point management• Networking

Microsoft Graph Security Integration


• Actions can be invoked at will by a Citrix Analytics administrator

• Actions can be invoked automatically by the system based on the rules defined by the administrator

• Rules are defined so once a condition is met, the action is executed

Rules & Actions



Excessive file downloads

Excessive file sharing

Excessive file uploads

Ransomware Activity Suspected (Files Replaced)

Excessive access to sensitive files (DLP alert)

Unusual logon access

Ransomware Activity Suspected (files updated)

Excessive file/folder deletion


Access from New Device(s)Access from device with unsupported OS

Usual Application Usage (SaaS)Usual Application Usage (Virtual)

Potential data exfiltration

Access ControlAttempt to Access Blacklisted URL

Risky Website Access Unusual Download Volume

Unusual upload volume

Risk Score

Risk score Risk score change

Gateway

Logon failures

EPA scan failures

Authorization failures

Unusual logon access

Endpoint Management

Device with blacklisted apps detected

Jailbroken or rooted device detected

Unmanaged device detected

Log off User

Gateway

Notify Administrator


Disable UserExpire All Links


Stop Session RecordingLog off User

Start Session Recording

Notify Admin

Endpoint Management

Lock DeviceNotify User

Global

Add to watchlist

IF the following condition is met

RULES / POLICY

THEN do the following

ACTIONS


• Detect & mitigate threats from trusted internal users with malicious intent

• Easily identify high risk users with drill-down capabilities on behavior

• Apply corrective actions

Admin Experience, User Risk


Risk Indicators


• Users accessing malicious & risky websites

• Uploads/ downloads to malicious & risky websites

• Historical views by user and website access

Admin Experience, User Access


Performance Analytics


Leverage AI/ML algorithms to translate data into readily actionable insights

Citrix Analytics

Performance & Operations

App, Network & Infrastructure Usage Analytics

Application Performance Analytics

Application Performance Anomaly Detection


Customers Use Disparate Tools to Manage Performance


SaaS Apps Mobile & Native Apps Content Collaboration

Workspace

Even when utilizing Citrix tools like Citrix Director—it only gives us visibility into a SINGLE site

Why Citrix Analytics for Performance


• User-centric experience scores, Application & Infrastructure performance scores through advanced analytics

• Will be available to all on-prem. & Cloud Citrix Virtual Apps and Desktops customers

Overview

• Quantify UX & app. performance.

• Isolate Users and Apps experiencing poor performance

• End-to-end visibility - integrate Networking & Workspace data, insights

• Multi-site aggregation & reporting

• Tools for faster troubleshooting

Key Use Cases

Citrix Analytics for Performance


Performance Analytics

User Experience Score

Poor1-40

• Prolonged degradation in performance of multiple indicators

• Continuous lags or high number of failures. • Could indicate infrastructure and resource

failures.

Fair41-70

• Performance degradation for a limited time window.

• One-off degradation events such as single reconnection etc.

Excellent71-100

• Optimal experience • Majority excellent experience across

indicators

Contextual Benchmarking

Statistical Modelling

Latency

Logon Duration

Failures

Reconnections Relative ImpactFactors

Drilldowns for RCA

The development, release and timing of any features or functionality described for our products remains at our sole discretion and are subject to change without notice or consultation. The information provided is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making purchasing decisions or incorporated into any contract.

How long the keystroke takes to appear?

How long to launch apps?

How often the session fails to launch?

Is the flaky network causing reconnections?

How UX score works?


Assess Citrix Health for multiple sites or a single site

User Sessions – How is Citrix VAD?

Quantify End User Experience thru Network Latency KPI

User Sessions – How is Citrix VAD?


Visibility into your workloads

Infrastructure Availability


Getting StartedSecurity Analytics


Onboarding Product DiscoverySecurity Analytics


• Automatic discovery of Virtual Apps & Desktops added to Workspace

• Actions require Smart Tools agent to be installed on the Delivery Controller or Smart Tools service to be utilized

Onboarding: On-Prem Virtual Apps & Desktops


Getting StartedPerformance Analytics


On-prem. Virtual Apps & Desktops

Virtual Apps & Desktops Cloud

Workspace Premium Plus

• Requires Citrix Analytics Account

• No new components

• Upgrade DDC and Director to 1909 release*

• Does not require workspace

• Outbound 443 connection

• Requires Citrix Analytics Account

• Single step onboarding

*The development, release and timing of any features or functionality described for our products remains at our sole discretion and are subject to change without notice or consultation. The information provided is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making purchasing decisions or incorporated into any contract.

summer 2017 citrix corporate template - fowt · © 2018 citrix | summit 2018 | confidential...

Documents