CIM Compliance

The Centrify Authentication events are mapped to the Authentication model of the CIM.

To search the Centrify authentication raw events, you can execute this search query:

Search tag=authentication app=Centrify    

To search the Centrify failed or denied authentication data through a CIM authentication query, you can execute this search query:

| tstats values( as app from datamodel=Authentication WHERE Authentication.action=failure by Authentication.dest,Authentication.user,Authentication.action