Kron PAM Configuration for Connection of ML-Based Threat Analytics and Response Engine

Navigate to the UEBA configuration folder: $ cd /pam/docker-mgmt/config-repo/

Open the pam-addons-default.yaml file with a text editor and set the parameters below.

After making changes restart pam-addons.

Parameter name	Parameter function	Parameter value
sc.uba.ignored.log.types	Log types that the engine ignores. Separate the log types with commas.	OCR,FILE_DOWNLOAD,FILE_UPLOAD
sc.uba.command.log.query.limit	Maximum number of session log records that Kron PAM reads in a single query.	100
sc.uba.vault.log.query.limit	Maximum number of Password Vault audit log records that Kron PAM reads in a single query.	50
sc.uba.command.log.process.days.before	Number of previous days that Kron PAM scans in the session logs to determine the usual (base) behavior for the ML engine.	15
sc.uba.command.log.http.days.before	Number of previous days that Kron PAM scans in the HTTP Proxy logs. Kron PAM keeps HTTP Proxy logs in a separate database view and scans them with a separate job.	15
sc.uba.command.log.read.job.init.delay.ms	Delay before the session log reader job runs for the first time after the application starts.	0
sc.uba.command.log.http.job.init.delay.ms	Delay before the HTTP Proxy log reader job runs for the first time after the application starts.	0
sc.uba.command.log.read.job.fixed.rate.ms	Execution period of the session log reader job.	60000
sc.uba.command.log.http.job.fixed.rate.ms	Execution period of the HTTP Proxy log reader job.	60000
ml.log.anomaly.api.server.url	IP address and port of the ML-based Threat Analytics and Response Engine that processes session logs.	https://ml-engine-ip:port
ml.log.vault.api.server.url	IP address and port of the ML-based Threat Analytics and Response Engine that processes Password Vault audit logs. This engine runs as a separate service from the session log engine.	https://ml-vault-engine-ip:port

Kron PAM uses two engine instances: ml.log.anomaly.api.server.url processes Session logs and returns the results to the Session Threats page, and ml.log.vault.api.server.url processes Password Vault audit logs and returns the results to the Vault Threats page.