---
title: Policy Groups Definition
slug: kronpam-reference-guide-3-6-0/policy-groups-definition
description: Learn how to create policy groups in Kron PAM and enhance security with SNMP traps and email notifications triggered by black key commands. Discover step-by-step instructions for defining SNMP trap parameters and configuring email notifications. Explore t
docTags: 
createdAt: 2022-07-27T10:31:42.000Z
---

Policy groups consist of multiple policies. If black and white keys are defined in the same policy group, then black keys have higher priority, i.e., the system restricts the black key commands first, then allows white key commands.

If there are specific commands defined as white keys, the system will allow these commands and restrict all other commands.

1. Navigate to **Policy**> **Policy Group**.
2. Navigate to the **Policy Group** field then click on the **Add** button.
3. Fill in the mandatory fields (Name, Operation Mode, Select Policy Key(s), Action) under Policy Group Properties and set the **Action** field as **Generate** **Error.** 
4.  Click **Save**.



| **Operation Mode** | **Definition**                                                                                                                                                                                 |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Operation**      | Policy groups are available when devices are in operation mode.                                                                                                                                |
| **Maintenance**    | Policy groups are available when devices are in maintenance mode. Maintenance mode is set on devices. Check the Device Inventory – Devices. Right-click the Menu section for more information. |

Kron PAM can send information about executed black key commands to a Simple Network Management Protocol (SNMP) server.

**SNMP Trap: **If the checkbox is selected from the **Policy Key Options> General Options**, an SNMP Trap is sent to the desired target when a user tries to execute a black key command. The target the SNMP trap will be sent to can be configured as a property in the System Configuration Manager.

The following parameters should be defined in the System Configuration  Manager:

| Parameter Name            | Parameter Value                                                                                                       |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **snmp.target.ip**        | Target IP to send the SNMP trap to. If not defined, **localhost** is used as the default target IP to send the traps. |
| **snmp.target.port**      | Target port of the target IP to send the SNMP trap to. If not defined, **162** is used as the default port.           |
| **snmp.community.string** | The preferred community string should be defined. If not defined, **public** is used as the default value.            |

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ge3J32D_5mTczJtSc6z-U_image.png)

When clicking on the Policy Key Actions, General Actions, and Black Key Action fields are shown.

**Send Notifications on Policy Key Execution**: When the command is run in SSH Proxy, an e-mail is sent to the user group to inform them.


If **sc.policy.notification.sendApproval.useOnlyDeviceRealmManagers** value is false in System Configuration Manager (default value is false), notification is sent to all managers in the user groups in the session user.


If it is set as true for this property, a notification e-mail is sent to the group managers on the device realms to which the session user is connected.

If the **aioc.alert.notification.mail.address** is defined on the System Config Manager, a notification is sent to both all managers and this specific user to get session alerts.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ZXB6MeiLm0GnzGUoZ_nES_image.png "Send Email")



![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/AFbOC3L8JtWjt71kQfuie_image.png "Permit Zone Policy Definition")