---
title: User and Entity Behaviour Analytics
slug: kronpam-installation-guide/user-and-entity-behaviour-analytics
docTags: 
createdAt: 2025-04-16T11:59:06.246Z
---

The ML Engine is the core component that delivers Kron’s advanced machine learning capabilities for Threat Analytics, Keystroke, and IntelliPAM chatbot services.

Within the ML Engine, the **Log Anomaly** service underpins Threat Analytics. It aggregates real-time data from Kron PAM to detect suspicious patterns in user and entity behaviors, enabling Kron PAM to take automated or manual actions based on calculated risk scores. 

The **Keystroke** service measures user interactions on the Kron PAM Login screen to determine whether additional authentication steps are necessary. 

Additionally, the **KronAI **service powering the IntelliPAM chatbot provides an AI-driven interface that streamlines user queries, delivering faster and more context-aware responses.

This document explains downloading and installing the ML Engine and its associated components. The installation script offers two distinct options to accommodate your security and operational needs:

**Option 1 – Install ML Engine**: Deploys the Threat Analytics (Log Anomaly) and Keystroke services.

**Option 2 – Install GenAI (KronAI/IntelliPAM)**: Deploy the AI chatbot component to enhance user interaction.