Making Meaning from Data in Citrix Analytics
Citrix | UX Designer | 2018 - 2021
The challenge
Security teams rely on Citrix Analytics (CAS) to detect threats and investigate risks.
In early versions of the product:
Unstructured data made search frustrating.
Dashboards showed information but didn’t tell a story.
Reports lacked actionable context for decision-making.
My challenge was to design a system where admins could easily find, interpret, and act on the signals buried in their data.
What I did
Step 1: Turning Search into a Power Tool
Early CAS search was just a raw text box. Through usability testing, we found:
80% of users started from a dashboard event (“excessive file download”) and wanted to drill deeper.
Filters were essential (IP address, device ID, location).
Users wanted to save, share, and repeat queries. They did not start from scratch every time.
My solution
Categorized unstructured data with engineers + content strategists.
Designed faceted filters (multi-select, ranges, date, etc.) with reusable patterns adopted into the design system.
Integrated ML-powered suggested searches from dashboard events.
Added save, alert, and share features to make search a repeatable workflow.
As a result of restructuring the data in the database, we had users enter a syntax-based search query to get precise results.
1. Data was categorized into the main group and a specific value within that group for easier searching.
2. Using complex operators, users were able to look for specific events.
“We wasted 10,000 hours on Facebook. Now we can see it.”
New design with a structured search entry
Once we had this key:value format search, I saw that most attributes would fall into one of four form field types:
1. Select multiple from a list
3. Numeric input for ranges
2. Select a single from a list
4. Simple selection for ranges
Contributing to the design system
The filter designs were foundational elements to many other layouts used in products outside of Citrix Analytics. I documented and shared rules and interactions for these elements.
Using Machine Learning
Search allows us to learn about our users' needs
A significant advantage of Search is that the user tells us what they're looking for. We can then capture this information by reviewing our search logs and optimize the product to deliver relevant information to users.
I designed an "Explore events" panel that surfaces events relevant to what is happening in the users' organization. We can anticipate what the user might want to search for and present it to them before they explicitly search for it.
Step 2: Making Dashboards Tell Stories
Raw logs don’t help unless they tell a story. Working with PMs and customers, I designed dashboards that:
Explained work patterns during WFH (active/idle time, after-hours usage, app-level insights).
Mapped login activity by geography and let admins scrub through time to spot unusual growth/decline.
Key design highlights:
Geo maps with toggles for total vs. local-time activity.
Timeline interactions to surface anomalies.
Clear visual summaries that showed not just what was happening, but why it mattered.
“This type of analytics is one hundred percent perfect.”
Step 3: Reporting
Once search and dashboards were in place, the next challenge was making insights repeatable and shareable:
Designed saved searches and scheduled reports so teams didn’t need to reconstruct complex queries.
Enabled alert creation for new events matching saved searches.
Designed options to add and organize columns so admins could tailor reports to their workflow.
Outcome & Impact
Transformed CAS into a trusted enterprise security analytics platform. Evolving from unstructured data and raw text search into a connected system of search, dashboards, and reports.
Extended influence beyond CAS. Reusable filter and visualization patterns were incorporated into Citrix’s broader design system, shaping product design across the company.
Reporting closed the loop, making insights shareable, alert-driven, and scalable across teams.