Adding Function Groups

Grants rights to view the Quick Commands screen in the Utility menu. The Quick Commands section is used to run pre/post-check commands.

Grants rights to view the Script Builder screen in the Script Designer menu. The Script Builder is used to design new scripts and manage existing scripts.

Grants rights to view the Script Player screen in the Script Designer menu. Users can run pre-defined scripts from the Script Player.

Grants rights to view the Workflow History screen in the Workflow Designer menu. When a defined workflow is run, its records are available in the Workflow History screen.

Grants rights to view the Workflow Designer screen in the Workflow Designer menu. Workflows are created here. User groups require permission to use a workflow.

Grants rights to view the Device Groups screen in the Device Management menu. Device groups are created in this menu and device realms are created to determine the authorizations of user groups in the device groups.

Grants rights to view the “Show Secrets” button in the Device Group Properties tab. Device group secrets can be viewed like passwords with this button.

Grants rights to access the tabs “New Device Discovery”, “Auto Device Discovery”, “Auto Discovery Log”, and “Auto Discovery Dashboard” under the Device Inventory section.

Grants access rights to the Inventory, Discovery, Auto Discovery Log and Auto Discovery Dashboard tabs under the Devices section and the grants rights to add devices.

Grants access rights to the Inventory, under the Devices section and the right to delete devices.

Grants rights to schedule maintenance times for devices in the Device Inventory tab under the Device Management section.

Grants rights to manage devices in unassigned device groups under the Device Inventory section.

Grants rights to view the Element Type screen in the Device Management menu. This menu is used to create, delete, or edit devices manually. Properties of an element type are assigned here.

Grants rights to view the Help Manager screen in the Device Administration menu. This is used to create, edit, or delete the help menu content.

Grants rights to view the Activity Logs screen in the Logging menu. System events and all transactions made in the web interface are logged and these logs can be viewed from here.

Grants rights to view the System Config Management screen in the Administration menu. From here, if authorized, users can add, edit, or delete system configuration parameters.

Grants rights to view the Backup Management screen in the Device Administration menu. This section allows us to get backups after setting relevant parameters in the system configuration.

Grants rights to approve new user requests, even if not an admin.

Grants rights to approve pre-approved user requests.

Grants rights to manage users.

Grants rights to manage user groups.

Grants rights to view the Datasource Manager screen in the Administration menu. This section allows the definition of a datasource for Kron PAM.

Grants rights to view the Bulk Import screen in the Administration menu. Devices can be added in bulk from this section.

Grants rights to view the Command Template screen in the Utility menu. Defined commands that are used in scripts or pre/post-checks are managed from here.

Grants rights to view the Components screen in the Administration menu.

Grants rights to view the Device Inventory screen in the Device Management menu. This section enables adding, deleting or editing devices.

Grants rights to view the Jobs Scheduler screen in the Administration menu. This section allows for managing manually triggered jobs.

Grants rights to view the System Log Viewer screen in the Administration menu. System logs can be monitored from this section.

Grants rights to view the Mail Management screen in the Administration menu. You can send emails through Kron PAM GUI from this section.

Grants rights to view the Memory Manager screen in the Administration menu. You can check the memory status from this section.

Grants rights to view the Portal Functions screen in the Policy Control menu. The authorization of user groups is determined in this section.

Grants rights to view the SIEM Configuration screen in the SIEM menu. Kron PAM can send logs to SIEM systems. After setting the necessary configurations in Sys. Config., the log type and the maximum record limit are set from this section.

Grants rights to view the User Approval in the User Management menu. The User Approval section displays all users who have sent the “New User” request from the main page and is used to confirm their requests.

Grants rights to view the User Authentication Logs screen in the Logging menu. From this screen you can access the log records of system activities involving logging in and out. The Authentication Logs page shows when and where users log in and what authentication method they are using.

Grants rights to view the User Accounts screen in the User Management menu. You can define users and user groups in this section.

Grants rights to view the AAA Remote Database screen in the RADIUS menu. In this section, you can define and edit databases.

Grants rights to view the Cloud Integration screen in the Administration menu. In this section, the required configurations to add or discover devices from Amazon Web Services can be set.

Grants rights to view the DevOps Management screen in the DevOps menu. You can define new DevOps teams or edit existing ones in this section.

This function provides the “duplicate log” option for logs in the Command Log tab in the Session Log section under the Logging menu.

Grants rights to access the logs of device groups which are defined in a realm for the user. The user can view the logs of these device groups from the Command Log tab in the Session Log section, under the Logging menu.

Grants rights to view all logs of all devices in the Command Log tab in the Session Log section, under the Logging menu. Even if the device group realm is not defined, the users can still view logs with this function.

Grants rights to access the Audit Logs tab in the Session Log section, under the Logging menu. In this tab, Audit users can sign sessions as “passed audit”, “failed”, or “n/a”.

Grants the right to the group manager to enter a connection reservation request on behalf of any group members. When granted, the “For User” selection field appears in the Connection Reservation screen for the group manager.

Grants rights to access the Script Realm tab in the Script Builder section under the Script Designer menu. In this tab, you can authenticate user groups to play scripts.

Grants rights to view the Sensitive Data Discovery screen in the Sensitive Data Discovery menu. This section is used to discover sensitive data in databases.

This function is defined for admins, to allow them to access the User Key Management tab, under the SSH Key Manager section, in the User Management menu.

Grants rights to view the TACACS Management screen in the Administration menu. Kron PAM uses its own TACACS+ server to authenticate users. TACACS+ configuration can be done from the TACACS+ Management section.

Grants rights to view the AAPM Management screen in the AAPM Management menu. You can add or remove accounts from the Application-to-Application Password Manager (AAPM) in this section.

Grants rights to view the Assigned Credentials menu and add/edit assigned credentials in the Users menu.

Grants rights to establish an SSH/Telnet connection by clicking the “Open Terminal” option for devices. The “Open Terminal” option is presented in the Device Inventory section under the Device Management menu.

Grants rights to view the Statistic screen in the Dashboard menu. The activities and commands ran by users are viewed in this section.

Grants rights to view the Policy Tracking screen in the Policy Control menu. You can search the user’s authentication and authorization details and SAPM accounts’ permissions in this section.

Grants rights to view the RADIUS 802.1x Configurations screen in the Administration menu. Kron PAM can be used as an 802.1x authentication server. Users can access their WiFi with their username and password after making the required configurations.

Grants rights to view the RADIUS Account Logs screen in the Logging menu. This section displays RADIUS account logs.

Grants rights to view the HTTP Proxy Logs screen in the Logging menu. You can view transactions of HTTP Proxy sessions in this section.

Grants rights to access the Kron PAM Controller Configuration section. You can configure all instances by using this section.

Grants rights to view the Linux Audit Report screen in the Audit Report menu. This section is used to report the current security status of local Linux accounts.

Grants rights to view the MAC Filtering screen in the Administration menu. This section is used to manage the user’s MAC addresses. User’s MAC addresses can be defined, edited or deleted.

Grants rights to view the Session Policy screen in the Policy Control section. The system policies are created and edited by using the Policy Control section. You can manage the “Policy Key”, “Time Restriction”, “Policy Group”, “Policy Realm”, “Permit Zone”, “HTTP Policy”, and “User Location” tabs from this section.

Grants rights to establish a Remote Desktop session by clicking the “Open Remote Desktop” option for devices.

The “Open Remote Desktop” option is presented in the Device Inventory section, under the Device Management menu.

This function is used to disable the key log hiding feature for certain user groups.

Grants rights to view the Remote Desktop App screen in the Administration menu. Kron PAM allows you to limit the applications to be accessed on windows servers from this section. After the application name and path are defined in this section, permissions are set from the Device Management menu.

This function grants rights to play sessions in the Command Logs tab in the Session Log section, under the Logging menu.

Grants rights to view the Reportsscreen in the Dashboard menu. This section has the “Authentication Reports”, “Session Reports”, “Session Details Report”, and the “Group Management Reports” tabs to view reports.

Grants rights to view the Reservation Management screen in the Policy Control menu. Users can make connection reservations for devices that require managerial approval for connection from this section. After the approval from a manager, users can connect to the system in the specified time during reservation.

This function makes the user an admin. Admins have rights to manage all SAPM accounts and view all logs.

This function restricts users from viewing passwords without approval. When a user wants to retrieve the SAPM password, an approval email is sent to the admin. After approval by the admin, the user can view the password.

This function grants rights to list all SAPM accounts, without seeing details.

Grant rights to access the Configuration section in the SAPM Management menu. SAPM configurations can be edited in this section.

Grants rights to view the old passwords of SAPM accounts.

Grants rights to see the “Password Change”, “New Users”, and “Password Check” logs in the SAPM page.

Grants rights to view the SAPM Management menu.

Grants rights to manage and view all the device accounts associated with a user.

Grants rights to list all device accounts defined in user device group realms, without seeing the details.

Grants rights to give second level approval for all SAPM accounts and view all logs.

This function restricts viewing the password without a two-level approval.

Grants rights to give second level approval for all device accounts defined in user device group realms.

Grants rights to view the Active Sessions screens in the Policy Control menu. Administrators can manage active proxy sessions, such as wiring to the session or killing the session.

Grant rights to view the Session Manager screen in the Administration menu. User activities can be viewed in this section.

Grants rights to view the Kron PAM Setup Wizard screen in the Setup Wizard menu.

Grants rights to view the SQL Proxy Policy screen in the Policy Control menu. The dynamic masking policy and masking methods are defined and managed in this section.

Grants rights to view the SSH Keys Manager screen in the User Management menu. SSH keys can be generated and managed in this section and used for logging in to the Kron PAM proxy instead of the user’s password.

Grants rights to view the TACACS Account Logs screen in the Logging menu. All commands executed during the TACACS+ session can be viewed in the TACACS Account Logs menu.

Kron PAM’s multi-tenancy function can provide multiple and independent applications and functions. It enables an architecture in which a single instance serves multiple customers. Each customer is called a tenant. Tenants may be given the ability to customize some parts of the application. This function works if the “multitenancy.enabled” parameter is set as “true” on the System Configuration Management. Tenant admins can only manage devices and users that they are allowed to access and can only see the logs related to the devices and users they have access to.

Grants rights to access the Hardware Token Management, and the Hardware Token Bulk Import tabs under the 2FA Provisioning section.

Grants rights to view the Two-Factor Provisioning section in the Administration menu. Kron PAM provides a Two-Factor Authorization by mobile application or SMS verification.

This function provides the right to assign hardware tokens in the 2FA Provisioning section.

Grants rights to see the Token’s QR Code or written code in the 2FA Provisioning section.

Grants rights to view the Session Log screen in the Logging section.

Grants rights to access the Report Configuration tab in the Windows Audit Report section. In this tab, you can create a report configuration to check the security of Windows accounts.

Grants rights to access the Dashboard tab in the Windows Audit Report section. In this tab, you can view the reports as graphs.

Grants rights to access the Report tab in the Windows Audit Report section. In this tab, you can search for reports and view them with their details.

Grants rights to view the Windows Audit Report screen in the Audit Report section. The Windows Audit Report is used to report the current security status of local Windows accounts.