Session Risk Scores

The calculated risk scores are determined using machine learning algorithms, considering various parameters such as the user initiating the session, session duration, actions performed during the session, client IP address, and host IP address. This calculation is not based on a static rule; instead, it takes into account historical data related to the user and the connected device to identify any anomalies in the user's current records.

In each session and for every operation performed within the session, a risk score is computed to identify anomalies or abnormal situations. A total risk score is calculated for the user and the device according to the weight values determined in the Threat Analytics and Response Engine configuration. This total risk score is classified according to low, medium, high, and critical levels according to the thresholds determined on Kron PAM.

The engine detects two types of session anomalies:

Anomaly Type	Description
User Anomaly	Compares the session against the baseline of the user who starts the session. The score rises when the user connects to an unfamiliar device, when the access protocol or the client IP address differs from the usual values, when the session starts outside the usual time window, or when the session contains commands that are rare for the user.
Host Anomaly	Compares the session against the baseline of the target device. The score rises when an unfamiliar user connects to the device, when the access protocol or the client IP address differs from the usual values, when the session starts outside the usual time window, or when the session contains commands that are rare for the device.

The engine calculates a partial score for every signal that it evaluates and then combines the partial scores into the total risk score. The Risk Score Detail window displays the partial scores of a session anomaly. The weight of each signal is defined in the Threat Analytics and Response Engine configuration. See "Threat Analytics and Response Engine Configuration".

Partial Score	Anomaly Type	Description
Device Score	User Anomaly	How typical the target device is for the user. The engine weights this score with the host parameter of the user group.
Command Score	User Anomaly, Host Anomaly	Rarity of the commands and the operations that the session contains. The engine weights this score with the command parameter.
User Score	Host Anomaly	How typical the user is for the target device. The engine weights this score with the user_name parameter of the host group.
Access Protocol Score	User Anomaly, Host Anomaly	How typical the access protocol is for the entity. This score detects connections that reach the same IP address over a different protocol. The engine weights this score with the access_protocol parameter.
Time Score	User Anomaly, Host Anomaly	Deviation from the usual session start time of the entity. The engine weights this score with the date parameter.
Client IP Score	User Anomaly, Host Anomaly	Familiarity of the client IP address for the entity. The engine weights this score with the client_ip parameter.