Session Threats
To open the Session Threats page:
1. Log in to the Kron PAM Web GUI.
2. Navigate to Threat Analytics > Session Threats.
The summary cards at the top of the page show the total session count, the number of users with anomalies, and the number of hosts with anomalies. The anomaly table lists the user name, the host, the access protocol, the log time, the risk severity, the total risk score, and the anomaly status of every detected anomaly. Use the search field and the User and Risk Severity filters to narrow the results.
Click the actions icon on an anomaly row to open the Anomaly Options menu. The menu brings together the investigation tools and the response tools in one place:
· Under Session, users open Risk Score Detail to see the partial scores that make up the total risk score, open Session Details to read the session logs, or click Play Session to replay the session video. Kron PAM offers Play Session for RDP and SSH sessions only.
· Mark as Not Anomaly labels the event as a false positive and sends the feedback to the ML engine.
· Under Actions, Automated Actions displays the actions that Kron PAM already took. Users run the remaining actions manually: Send Notification, Kill Session, Kill All Sessions, Lock User, and Suspend User.
The Anomaly Insights section of the Dashboard offers a consolidated, interactive overview of all detected anomalies over the chosen time frame. By adjusting the time-range, users can immediately see how anomaly volumes evolve day-to-day, understand the proportion of affected sessions, and observe shifts in anomaly categories and protocols, all in one glance.
The Severity Configurations tab holds a threshold table for user anomalies and a threshold table for host anomalies. Each row maps a risk severity to a threshold value and to an automatic action list. Click the edit icon on a row to change the threshold value or the automatic actions.
