---
title: Policy Groups Creation
slug: kronpam-reference-guide-3-9-0/policy-groups-creation
description: Learn how to create policy groups in Kron PAM and enhance security with SNMP traps and email notifications triggered by black key commands. Discover step-by-step instructions for defining SNMP trap parameters and configuring email notifications. Explore t
docTags: 
createdAt: 2022-07-27T10:31:42.000Z
---

Policy groups consist of multiple policies. If black and white keys are defined in the same policy group, then black keys have higher priority. In other words, if a command allowed by a white key is blockable by a black key, that command will be blocked.

If there are specific commands defined as white keys and no other keys of any sort in the policy group, Kron PAM will allow these commands and block all other commands.

To create policy groups:

1. Navigate to **Policy** **>** **Policy Group**.
2. Navigate to the **Policy Group** field then click on the **Add** button.
3. Fill in the mandatory fields (Name, Operation Mode, Select Policy Key(s), Action) under **Policy Group Properties** and set the **Action** field as **Generate Error** and click **Save. **(The ***Use for Reservation only*** option should be enabled if a Policy Group is used only for reservation. More information can be found in section *2.3.3 Managerial Policy Reservation*.)

| **Operation Mode** | **Definition**                                                                                                                                                                                 |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Operation**      | Policy groups are available when devices are in operation mode.                                                                                                                                |
| **Maintenance**    | Policy groups are available when devices are in maintenance mode. Maintenance mode is set on devices. Check the Device Inventory – Devices. Right-click the Menu section for more information. |

Kron PAM can send information about executed black key commands to a Simple Network Management Protocol (SNMP) server.

**SNMP Trap: **If the checkbox is selected from the **Policy Key Options> General Options**, an SNMP Trap is sent to the desired target when a user tries to execute a black key command. The target of the SNMP trap can be configured in the System Configuration Manager with the following parameters:

| Parameter Name            | Parameter Value                                                                                                   |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| **snmp.target.ip**        | Target IP to send the SNMP trap to. If not set, **localhost** is used as the default target IP to send the traps. |
| **snmp.target.port**      | Target port of the target IP to send the SNMP trap to. If not set, **162** is used as the default port.           |
| **snmp.community.string** | The preferred community string should be defined. If not set, **public** is used as the default value.            |



![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/YXodowg8NtTEAwzHkyi6L_image.png "Policy group creation")

Upon clicking **Policy Key Actions**, **General Actions** and **Black Key Actions** are shown.

**Send Notifications on Policy Key Execution**: When a command is sent on SSH Proxy, Kron PAM sends an e-mail to the user group to inform of the action.


If **sc.policy.notification.sendApproval.useOnlyDeviceRealmManagers** value is **false **in System Configuration Manager (default value is false), Kron PAM sends a notification to all each user group manager of the session user, regardless of device realm membership.


If it is set as **true**, the notification e-mails are only sent to the user group managers that share the device realm with the session user.

If the **aioc.alert.notification.mail.address** parameter is set on the System Config Manager, Kron PAM sends the notification to both the user group managers and this specific mail address.

![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/cLnRSAmJvMr5_6rFhVxy__image.png "Send Email")

### Cluster-Wide Command Restriction:

With this parameter, when a command defined as a black key is executed on a machine in a cluster-based system, it cannot be executed on other devices within that cluster for a **specified period of time (seconds)**. Activating this parameter alone is not enough for cluster-based restriction to take effect. Devices in a cluster must be contained within the same device group, and the **useAsClusterGroup** parameter must be set to **true** for this device group in the Custom Properties panel. 

![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/fpG12FuSQrucDSCtX7QB-_image.png "Cluster command restriction")

When the **useAsClusterGroup** parameter is set to **True** on device group, if a user tries to run a black key command twice in quick succession on the same within this cluster during the same session, Kron PAM will display an error message informing the user that this command can’t be executed for a certain period of time.

Additionally, if users connect to another device in the device group via SSH and run the same command again, a warning message will be displayed on the screen informing the user that the command cannot be executed for a certain period of time.

![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/4emXpAkMLv9fsFLySpq4T_image.png "Cluster Command Executed in Different Device within Same Device Group")