---
title: Session Risk Scores
slug: kronpam-reference-guide-3-9-0/session-risk-scores
docTags: 
createdAt: 2023-12-05T11:40:31.665Z
---

The calculated risk scores are determined using machine learning algorithms, considering various parameters such as the user initiating the session, session duration, actions performed during the session, client IP address, and host IP address. This calculation is not based on a static rule; instead, it takes into account historical data related to the user and the connected device to identify any anomalies in the user's current records.

In each session and for every operation performed within the session, a risk score is computed to identify anomalies or abnormal situations. A total risk score is calculated for the user and the device according to the weight values determined in the Threat Analytics and Response Engine configuration. This total risk score is classified according to low, medium, high, and critical levels according to the thresholds determined on Kron PAM.

The engine detects two types of session anomalies:

| **Anomaly Type** | **Description**                                                                                                                                                                                                                                                                                                                                         |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| User Anomaly     | Compares the session against the baseline of the user who starts the session. The score rises when the user connects to an unfamiliar device, when the access protocol or the client IP address differs from the usual values, when the session starts outside the usual time window, or when the session contains commands that are rare for the user. |
| Host Anomaly     | Compares the session against the baseline of the target device. The score rises when an unfamiliar user connects to the device, when the access protocol or the client IP address differs from the usual values, when the session starts outside the usual time window, or when the session contains commands that are rare for the device.             |

The engine calculates a partial score for every signal that it evaluates and then combines the partial scores into the total risk score. The **Risk Score Detail** window displays the partial scores of a session anomaly. The weight of each signal is defined in the Threat Analytics and Response Engine configuration. See "Threat Analytics and Response Engine Configuration".



| Partial Score         | Anomaly Type               | Description                                                                                                                                                                                                    |
| --------------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Device Score          | User Anomaly               | How typical the target device is for the user. The engine weights this score with the host parameter of the user group.                                                                                        |
| Command Score         | User Anomaly, Host Anomaly | Rarity of the commands and the operations that the session contains. The engine weights this score with the command parameter.                                                                                 |
| User Score            | Host Anomaly               | How typical the user is for the target device. The engine weights this score with the user\_name parameter of the host group.                                                                                  |
| Access Protocol Score | User Anomaly, Host Anomaly | How typical the access protocol is for the entity. This score detects connections that reach the same IP address over a different protocol. The engine weights this score with the access\_protocol parameter. |
| Time Score            | User Anomaly, Host Anomaly | Deviation from the usual session start time of the entity. The engine weights this score with the date parameter.                                                                                              |
| Client IP Score       | User Anomaly, Host Anomaly | Familiarity of the client IP address for the entity. The engine weights this score with the client\_ip parameter.                                                                                              |