Kron PAM Configuration for Password Vault Threat Threshold Incident Response

1. Log in to Kron PAM Web GUI.

2. Navigate to Threat Analytics > Password Vault Threats.

3. Open the Severity Configurations tab. This section contains configurations related to the classification of detected threats according to their risk scores.

Figure - Kron PAM Configuration for Password Vault Threat Threshold Incident Response

Set risk severity threshold and Auto action for severity levels.

Log: To log the detected anomalies.

Send Notification: To send a notification mail to the recipient defined in "sc.uba.send.detected.anomalies.mail.recipient" parameter in System Config. Manager.

Revoke User Access: To remove the permissions of the user on the Vault Account. The user can no longer retrieve, show, or reserve the secret of the account.

Kill Credential-Based Sessions: To kill all active sessions that use the credential of the Vault Account.

Cancel Future Reservations: To cancel all pending and scheduled reservations of the Vault Account.

Lock User: To lock the user. Locked users cannot log in to Kron PAM. Locked accounts can be unlocked by clicking Unlock User in actions menu.

Suspend User: To suspend the user for the time specified in "user.suspend.forMillis" parameter in System Config. Manager.

Figure - Edit Anomaly Thresholds

Detected threats are listed in the Dashboard tab.

Figure – Detected Vault Threats

Figure- Anomaly Insights