Threat Analytics and Response Dashboard

The Threat Analytics and Response Dashboard presents the anomalies that the machine learning (ML) based Threat Analytics and Response Engine detects, together with the risk severity of each anomaly. Users review the evidence behind every risk score and run any response action that the configured severity rules do not trigger automatically.

Kron PAM divides the dashboard into two pages under the Threat Analytics menu:

·         Session Threats – Lists the anomalies that the engine detects in RDP, SSH, SFTP, and HTTP Proxy sessions.

·         Vault Threats – Lists the anomalies that the engine detects in Password Vault audit logs, such as password retrievals, permission changes, and approval operations.

Both pages contain the Dashboard and the Severity Configurations tabs. The Dashboard tab lists the detected anomalies and the Anomaly Insights charts. The Severity Configurations tab holds the risk thresholds and the automated response actions.