CIM Compliance

The Delinea Authentication events are mapped to the Authentication model of the CIM.

To search the Delinea authentication raw events, you can execute this search query:

Search tag=authentication app=Centrify

To search the Delinea failed or denied authentication data through a CIM authentication query, you can execute this search query:

| tstats values(Authentication.app) as app from datamodel=Authentication WHERE Authentication.action=failure Authentication.app=Centrify by Authentication.dest,Authentication.user,Authentication.action