---
title: Session Threats
slug: kronpam-reference-guide-3-9-0/session-threats
docTags: 
createdAt: 2026-10-11T11:24:07.135Z
---

To open the Session Threats page:

1.      Log in to the Kron PAM Web GUI.

2.      Navigate to **Threat Analytics** > **Session Threats**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ZNyBSkOose-QgeokhQO_K_image.png "Figure –  Session Threats Dashboard")

The summary cards at the top of the page show the total session count, the number of users with anomalies, and the number of hosts with anomalies. The anomaly table lists the user name, the host, the access protocol, the log time, the risk severity, the total risk score, and the anomaly status of every detected anomaly. Use the search field and the **User** and **Risk Severity** filters to narrow the results.

Click the actions icon on an anomaly row to open the **Anomaly Options** menu. The menu brings together the investigation tools and the response tools in one place:

·         Under **Session**, users open **Risk Score Detail** to see the partial scores that make up the total risk score, open **Session Details** to read the session logs, or click **Play Session** to replay the session video. Kron PAM offers **Play Session** for RDP and SSH sessions only.

·         **Mark as Not Anomaly** labels the event as a false positive and sends the feedback to the ML engine.

·         Under **Actions**, **Automated Actions** displays the actions that Kron PAM already took. Users run the remaining actions manually: **Send Notification**, **Kill Session**, **Kill All Sessions**, **Lock User**, and **Suspend User**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/KSB4HaPizrE-NbwqePYHh_image.png "Figure - Session Anomaly Options Menu")

The Anomaly Insights section of the Dashboard offers a consolidated, interactive overview of all detected anomalies over the chosen time frame. By adjusting the time-range, users can immediately see how anomaly volumes evolve day-to-day, understand the proportion of affected sessions, and observe shifts in anomaly categories and protocols, all in one glance.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/lYj5LmNkEMWKuOsxdhIUN_image.png "Figure –  Anomaly Insights")

The **Severity Configurations** tab holds a threshold table for user anomalies and a threshold table for host anomalies. Each row maps a risk severity to a threshold value and to an automatic action list. Click the edit icon on a row to change the threshold value or the automatic actions.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/9xGSrljZrUqV3RhIcB4Q9_image.png "Figure – Session Threats Severity Configurations")