Threat Analytics

kron pam includes a threat analytics feature to alert admins of critical actions that can occur in the environment threat analytics can be configured for both users and devices, by managing the threshold values assigned to them alerts are created when the average number of connections for a user/device exceeds a defined threshold rate the average number of daily connection counts for a user or device is recorded in the database as statistics logs to activate the calculation of average daily connections navigate to administration > jobs scheduler open the trigger list tab select scsessionstatisticsjob as the job fill in the trigger name field define the cron expression to run every day to enable the job, select enabled on the active field and click save the session alerts threshold should be defined based on the user group and device group navigate to policy control > session alert threshold define the threshold type as user or device define the threshold value as “1, 1 5, 2, 3, 4 75…” the alert point is calculated by multiplying the threshold value and the average value of the user/device to activate alert logs navigate to administration > jobs schedule r open the trigger list tab select scsessionalertsjob as the job fill in the trigger name and cron expression fields to enable the job, select enabled in the active field and click save now alert logs are listed in the activity logs