Citrix Systems, Inc.
SYSTEMS AND METHODS FOR DETECTING SECURITY INCIDENTS

Abstract:

Systems and methods for identifying potential security incidents include an analytics engine that identifies a detection threshold for login failures according to a number of login successes to a system. The analytics engine may determine a number of login failures by a plurality of users to the system within a time window. The analytics engine may determine that the number of login failures to the system within the time window exceeds the detection threshold. The analytics engine may provide a notification to a device indicating a potential security incident responsive to the number of login failures exceeding the detection threshold.