The Centrify Authentication events are mapped to the Authentication model of the CIM.
To search the Centrify authentication raw events, you can execute this search query:
Search tag=authentication app=Centrify
To search the Centrify failed or denied authentication data through a CIM authentication query, you can execute this search query:
| tstats values(Authentication.app) as app from datamodel=Authentication WHERE Authentication.action=failure Authentication.app=Centrify by Authentication.dest,Authentication.user,Authentication.action