---
title: Kron PAM Configuration for Threat Threshold Incident Response
slug: kronpam-reference-guide-3-8-0/kron-pam-configuration-for-threat-threshold-incident-response
docTags: 
createdAt: 2023-12-05T11:23:51.415Z
---

1. Log in to Kron PAM Web GUI.
2. Navigate to the **Threat Analytics** menu.
3. Open the **Severity Configurations **tab. This section contains configurations related to the classification of detected threats according to their risk scores.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Fz1HYfos-1XBUUOM92JIu_image.png "Kron PAM Configuration for Threat Threshold Incident Response")

Set risk severity threshold and** Auto **action for severity levels. 

- **Log: **To log the detected anomalies.
  **Kill All Sessions:** To kill all sessions of the user.
  **Kill Session:** To kill only the session in which the anomaly is detected.
  **Lock User: **To lock the user. Locked users cannot log in to the system. The error message "Your account is locked. Please contact your administrator." is displayed on the login page. Locked accounts can be unlocked by the administrator from the user's action menu. 
  **Send Notification: **To send a notification mail to the recipient defined in **sc.uba.send.detected.anomalies.mail.recipient** parameter in System Config. Manager. 
  **Suspend User: **To suspend the user for the duration specified in the **user.suspend.forMillis** parameter in System Config. Manager.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/5uFV4we1b2nvMbtz9hLoK_image.png "Edit Anomaly Thresholds")



- Detected threats are listed in the **Dashboard **tab.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Y3eizd2xv6ZARYnkUxOOw_image.png "Detected Threats")