---
title: Threat Analytics
slug: kronpam-legacy-ui-reference-guide-3-5-0/threat-analytics
description: Learn how to configure Threat Analytics in Kron PAM to enhance your security by effectively managing user and device thresholds. This document provides step-by-step instructions on activating average daily connection calculations, defining session alert t
docTags: 
createdAt: 2022-07-28T12:33:17.000Z
---

Kron PAM includes a Threat Analytics feature to alert admins of critical actions that can occur in the environment. Threat Analytics can be configured for both users and devices, by managing the threshold values assigned to them.
Alerts are created when the average number of connections for a user/device exceeds a defined threshold rate.
The average number of daily connection counts for a user or device is recorded in the database as statistics logs. To activate the calculation of average daily connections:

1. Navigate to **Administration** > **Jobs Scheduler**.
2. Open the **Trigger** List tab.
3. Select **ScSessionStatisticsJob** as the Job.
4. Fill in the **Trigger Name** field.
5. Define the **Cron Expression** to run every day.
6. To enable the job, select **Enabled **on the **Active** field and click **Save**.


The **Session Alerts Threshold** should be defined based on the user group and device group.

1. Navigate to** Policy Control** > **Session Alert Threshold**.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/cd93gfdL7TOvvmWTOf22v_image.png" size="88" width="835" height="214" caption="Session Alert Threshold" position="center" showCaption="true"}

- Define the threshold type as** user** or **device**.
-
  Define the threshold value as “1, 1.5, 2, 3, 4.75…”.

The alert point is calculated by multiplying the threshold value and the average value of the user/device. To activate alert logs:

1. Navigate to** Administration **>** Jobs Schedule**r.
2. Open the **Trigger List** tab.
3. Select **ScSessionAlertsJob** as the Job.
4. Fill in the **Trigger Name** and** Cron Expression** fields.
5. To enable the job, select** Enabled** in the** Active** field and click **Save**.

Now alert logs are listed in the Activity Logs.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/9MBF7xg7LISVLiYfBj7aG_image.png" size="88" width="768" height="287" caption="Session Alert Threshold" position="center" showCaption="true"}