Password Vault Threat Analytics and Response Engine Configuration
The Threat Analytics and Response Engine that processes Password Vault audit logs comes pre-installed with default settings, which include anomaly weights used for score calculations. Various signals found in the vault audit logs, such as the user who performs the action, the target Vault Account, the vault action, the request channel, the client IP address, the time of the event, and the outcome of the operation, can contribute to the score calculation in distinct ways.
The Threat Analytics and Response Engine employs advanced machine learning algorithms to identify deviations from the expected behavior of users and Vault Accounts. Instead of relying on static rule-based threat detection, this system dynamically detects anomalies by statistically analyzing the vault activity within your environment. Kron PAM processes Password Vault audit logs with a separate engine instance, therefore this instance keeps its own default.json file. It's important to note that the calculated risk scores and the number of anomalies detected can vary based on system usage and vault usage patterns. To optimize its effectiveness, it is strongly recommended to continuously monitor the system's performance and make necessary adjustments as per your specific requirements.
The configuration parameters along with their descriptions for the Threat Analytics and Response Engine are listed below:
Parameter Key | Description | Value Range |
|---|---|---|
account | Weight parameters used in Vault Account-based anomaly detection. These parameters are used to calculate the risk score for anomalies regarding Vault Accounts. |
|
user | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the user who performs the vault event. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of user information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of user information on the risk score calculation intensifies. | 0-1 |
action | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the vault action that is performed on the Vault Account. Kron PAM stores the vault action as the log type of the vault event, for example Show Password, Reset Password, Add Permission, or Delete Account. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of vault action information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of vault action information on the risk score calculation intensifies. | 0-1 |
event_channel | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the request channel that the vault event arrives through. Kron PAM stores the channel as the event channel of the vault event: Portal, Scheduled Job, AAPM, SMS, REST Service, Mobile, Reservation, or E-Mail. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of event channel information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of event channel information on the risk score calculation intensifies. | 0-1 |
client_ip | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the client IP address or subnet that the vault event originates from. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of client IP address information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of client IP address information on the risk score calculation intensifies. | 0-1 |
time | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the time of the vault event. It is used to detect an anomaly, especially when the Vault Account is accessed outside its usual time window. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of time information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of time information on the risk score calculation intensifies. | 0-1 |
outcome | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the result of the vault event. Only failed results contribute to this score, therefore it is used to detect an unusual number of failed operations in a short period. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of operation outcome information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of operation outcome information on the risk score calculation intensifies. | 0-1 |
Parameter Key | Description | Value Range |
|---|---|---|
user | Weight parameters used in user-based anomaly detection. These parameters are used to calculate the risk score for anomalies regarding the users who perform the vault events. |
|
account | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the Vault Account that the user accesses. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of Vault Account information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of Vault Account information on the risk score calculation intensifies. | 0-1 |
action | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the vault action that is performed on the Vault Account. Kron PAM stores the vault action as the log type of the vault event, for example Show Password, Reset Password, Add Permission, or Delete Account. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of vault action information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of vault action information on the risk score calculation intensifies. | 0-1 |
event_channel | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the request channel that the vault event arrives through. Kron PAM stores the channel as the event channel of the vault event: Portal, Scheduled Job, AAPM, SMS, REST Service, Mobile, Reservation, or E-Mail. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of event channel information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of event channel information on the risk score calculation intensifies. | 0-1 |
client_ip | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the client IP address or subnet that the vault event originates from. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of client IP address information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of client IP address information on the risk score calculation intensifies. | 0-1 |
time | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the time of the vault event. It is used to detect an anomaly, especially when the Vault Account is accessed outside its usual time window. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of time information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of time information on the risk score calculation intensifies. | 0-1 |
outcome | This parameter quantifies the statistical influence of the anomaly detection algorithm on the computation of the anomaly risk score associated with the result of the vault event. Only failed results contribute to this score, therefore it is used to detect an unusual number of failed operations in a short period. It requires a value within the range of 0 to 1 to be specified. When this value approaches 0, the significance of operation outcome information in determining the risk score diminishes. Conversely, as it approaches 1, the impact of operation outcome information on the risk score calculation intensifies. | 0-1 |
Parameter Key | Description | Default Value |
|---|---|---|
Max_fit_size | This parameter specifies the amount of Password Vault audit log data used by the "Threat Analytics and Response Engine" for anomaly detection. It determines how much historical data will be retained for anomaly detection purposes. Increasing the default value can enhance accuracy by incorporating more data into anomaly detection, but it may lead to performance issues. It is recommended to keep the default value for optimal performance. | 50000 |
port | Port of the Threat Analytics and Response Engine instance that processes Password Vault audit logs. This instance runs on a different port than the session log instance. | 5030 |
contamination | "Contamination" indicates the number of anomalies that can be statistically detected within the data specified by the "Max_fit_size" parameter. Increasing this number enhances the sensitivity of anomaly detection, resulting in the identification of more anomalies. Conversely, decreasing it reduces sensitivity, leading to the detection of fewer anomalies. | 0.01 |
To change the weight of anomalies:
1. Log in to Threat Analytics and Response Engine CLI.
2. Navigate to /pam/vault/vault-anomaly/config/ folder.
3. Open the default.json file with a text editor and edit weights to finetune anomaly detection.
4. Set values between 0 and 1.
{
"weightOfkeys": {
"account": {
"user": 1,
"action": 1,
"event_channel": 1,
"client_ip": 1,
"time": 1,
"outcome": 1
},
"user": {
"account": 1,
"action": 1,
"event_channel": 1,
"client_ip": 1,
"time": 1,
"outcome": 1
}
},
"Max_fit_size": 50000,
"port": 5030,
"contamination": 0.01,
"min_samples_for_training": 20
}5. Save the default.json file and restart the anomaly detection service.