Data Source

This connector ingests from the Citrix DaaS REST API (https://api.cloud.com/cvad/manage) (Citrix Virtual Apps and Desktops service). It covers two event categories:

  • Configuration audit logs - administrative operations against the Citrix DaaS control plane (object creation/modification/deletion, admin identity, source IP, success/failure)
  • Session activity - active and historical VDI/virtual app sessions (session type, state, app state, client IP, connection protocol, anonymous session flag)

Multi-tenant deployments are supported: each record is tagged with CitrixCustomerId, allowing differentiation across tenants in a single workspace.

Ingestion Mechanism

  • Mechanism: CCF (Codeless Connector Framework) with REST API polling via RestApiPoller kind
  • Authentication: OAuth2 JWT token obtained from the Citrix Cloud trust endpoint using client credentials (Client ID + Client Secret); token prepended as CWSAuth bearer= on downstream API calls
  • Polling interval: 15-minute query window; 10 RPS rate limit; continuation-token pagination
  • Destination tables:
    • CitrixDaaSConfigOps_CL - configuration operations stream
    • CitrixDaaSSessions_CL - session activity stream
  • DCR transform (ConfigOps): normalises FormattedEndTime/FormattedStartTime to TimeGenerated; projects OperationId, OperationText, User, UserIdentity, Source, AdminMachineIp, IsSuccessful, OperationType, CitrixCustomerId
  • DCR transform (Sessions): extracts nested Connection (protocol, ConnectedViaIP) and Client (IP address, name) dynamic fields into flat columns; maps UntrustedUserName to UserName; flags IsAnonymousUser

Detection Surface Unlocked

With these two tables, detection engineers can now query for:

  • Admin abuse / insider threat: Failed configuration operations (IsSuccessful == false) from unexpected admin accounts or source IPs in CitrixDaaSConfigOps_CL - maps to T1078 (Valid Accounts) and T1098 (Account Manipulation)
  • Lateral movement via VDI: Anomalous session origins in CitrixDaaSSessions_CL - client IPs inconsistent with expected user geography or device inventory
  • Anonymous session abuse: IsAnonymousUser == true sessions warrant investigation; unauthenticated VDI access is a significant exposure
  • Privileged configuration changes: Bulk or off-hours OperationType events in CitrixDaaSConfigOps_CL indicating unauthorised infrastructure modification

No bundled Analytic Rules or Hunting Queries are included in this initial release. Detection content must be authored separately.

Deployment Notes

The connector is currently marked Preview. A separate connection must be configured per Citrix Cloud tenant. Required credentials: Citrix Cloud Customer ID, Site ID (Instance ID), OAuth Client ID, and OAuth Client Secret with read access to CVAD Manage APIs.

Affected Files

Solutions/Citrix DaaS/Data Connectors/CitrixDaaS_CCF/CitrixDaaS_DCR.json
Solutions/Citrix DaaS/Data Connectors/CitrixDaaS_CCF/CitrixDaaS_DataConnectorDefinition.json
Solutions/Citrix DaaS/Data Connectors/CitrixDaaS_CCF/CitrixDaaS_PollingConfig.json
Solutions/Citrix DaaS/Data Connectors/CitrixDaaS_CCF/CitrixDaaS_table_ConfigOps.json
Solutions/Citrix DaaS/Data Connectors/CitrixDaaS_CCF/CitrixDaaS_table_Sessions.json
Solutions/Citrix DaaS/Package/testParameters.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_CitrixDaaS.json, createUiDefinition.json, mainTemplate.json)