---
title: Kron PAM Configuration for Connection of ML-Based Threat Analytics and Response Engine
slug: kronpam-reference-guide-3-9-0/kron-pam-configuration-for-connection-of-ml-based-threat-analytics-and-response-engine
docTags: 
createdAt: 2023-12-05T11:13:53.383Z
---

1. Log in to the Kron PAM master instance’s CLI with pamuser.
2. Navigate to the UEBA configuration folder: **$ cd /pam/docker-mgmt/config-repo/**
3. Open the pam-addons-default.yaml file with a text editor and set the parameters below.
4. After making changes restart pam-addons.



| Parameter name                            | Parameter function                                                                                                                                                                     | Parameter value                   |
| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
| sc.uba.ignored.log.types                  | Log types that the engine ignores. Separate the log types with commas.                                                                                                                 | OCR,FILE\_DOWNLOAD,FILE\_UPLOAD   |
| sc.uba.command.log.query.limit            | Maximum number of session log records that Kron PAM reads in a single query.                                                                                                           | 100                               |
| sc.uba.vault.log.query.limit              | Maximum number of Password Vault audit log records that Kron PAM reads in a single query.                                                                                              | 50                                |
| sc.uba.command.log.process.days.before    | Number of previous days that Kron PAM scans in the session logs to determine the usual (base) behavior for the ML engine.                                                              | 15                                |
| sc.uba.command.log.http.days.before       | Number of previous days that Kron PAM scans in the HTTP Proxy logs. Kron PAM keeps HTTP Proxy logs in a separate database view and scans them with a separate job.                     | 15                                |
| sc.uba.command.log.read.job.init.delay.ms | Delay before the session log reader job runs for the first time after the application starts.                                                                                          | 0                                 |
| sc.uba.command.log.http.job.init.delay.ms | Delay before the HTTP Proxy log reader job runs for the first time after the application starts.                                                                                       | 0                                 |
| sc.uba.command.log.read.job.fixed.rate.ms | Execution period of the session log reader job.                                                                                                                                        | 60000                             |
| sc.uba.command.log.http.job.fixed.rate.ms | Execution period of the HTTP Proxy log reader job.                                                                                                                                     | 60000                             |
| ml.log.anomaly.api.server.url             | IP address and port of the ML-based Threat Analytics and Response Engine that processes session logs.                                                                                  | https\://ml-engine-ip\:port       |
| ml.log.vault.api.server.url               | IP address and port of the ML-based Threat Analytics and Response Engine that processes Password Vault audit logs. This engine runs as a separate service from the session log engine. | https\://ml-vault-engine-ip\:port |

:::hint{type="info"}
**Kron PAM uses two engine instances: ml.log.anomaly.api.server.url processes Session logs and returns the results to the Session Threats page, and ml.log.vault.api.server.url processes Password Vault audit logs and returns the results to the Vault Threats page.**
:::