Password Vault Risk Scores

The calculated risk scores are determined using machine learning algorithms, considering various parameters such as the user performing the action, the Vault Account, the vault action, the request channel, the client IP address, and the outcome of the operation. This calculation is not based on a static rule; instead, it takes into account historical vault audit logs of the user and the Vault Account to identify any anomalies in the current records.

The engine detects two types of Password Vault anomalies.

Anomaly Type	Description
Account Anomaly	Compares the vault event against the baseline of the target Vault Account. The score rises when an unfamiliar user accesses the account, when the action is rare for the account, when the request channel or the client IP address differs from the usual values, when the access occurs outside the usual time window, or when the account produces an unusual number of failed operations in a short period.
User Anomaly	Compares the vault event against the baseline of the user who performs the action. The score rises when the user accesses an unfamiliar Vault Account, when the action is rare for the user, when the request channel or the client IP address differs from the usual values, when the user works outside their usual activity window, or when the user produces an unusual number of failed operations in a short period.

The engine calculates a partial score for every signal that it evaluates and then combines the partial scores into the total risk score. The Risk Score Detail window displays the partial scores of a Password Vault anomaly.

Partial Score	Anomaly Type	Description
Time Score	Account Anomaly, User Anomaly	Deviation from the usual time of the entity.
User Score	Account Anomaly	How typical the user is for the Vault Account.
Account Score	User Anomaly	How typical the Vault Account is for the user.
Action Score	Account Anomaly, User Anomaly	Rarity of the vault action for the entity. Kron PAM stores the vault action as the log type of the vault event, for example Show Password, Reset Password, Add Permission, or Delete Account.
Access Channel Score	Account Anomaly, User Anomaly	How typical the request channel is for the entity. Kron PAM stores the channel as the event channel of the vault event: Portal, Scheduled Job, AAPM, SMS, REST Service, Mobile, Reservation, or E-Mail.
Client IP Score	Account Anomaly, User Anomaly	Familiarity of the client IP address or subnet for the entity.
Operation Outcome Score	Account Anomaly, User Anomaly	Outcome of the vault event. Kron PAM stores the outcome as the result of the vault event. Only failed results contribute to this score.