---
title: Using Keystroke for User Behavior Analytics
slug: kronpam-reference-guide-3-9-0/using-keystroke-for-user-behavior-analytics
description: Learn how to analyze user behavior on the Kron PAM Login screen using Keystroke in this informative document. Find out how Keystroke is disabled for MFA users after a certain number of days and discover how a user's typing speed and accuracy are measured 
docTags: 
createdAt: 2023-04-26T09:32:20.000Z
---

Keystroke tracking is utilized to understand the behavior of users on the Kron PAM Login screen and cannot be activated unless MFA is enabled for the User Group.

-
  Keystroke tracking information will be reset if MFA Users do not log in to the Login screen within a certain number of day. This number of days can be defined by parameter.
-
  The user's Username and Password keyboard typing speeds and accuracy will be checked and measured with a threshold value. If the user does not exceed the threshold value, they will log in without the need for MFA.




![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/_37NhaqXXJ3U8gqG2y6GZ_image.png)

To enable Keystroke:

1. Navigate to** Administration > Multi-Factor Authentication > User Group Management.**
2. Click **Options**.
3. Click **Enable OTP** for the user group.
4. When **Enable OTP **is clicked, the **Enable Keystroke** button will become active.
5. Click **Enable Keystroke**.

Keystrokes can be tracked locally or sent to another device for analysis. The following parameters in System Config Manager are necessary:

| **Parameter Name**                       | **Description**                                                                                                                      | **Sample Parameter Value**                                   |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
| keystroke.last.login.success.before.days | If the user doesn't have any MFA authentication login(login success with the token) last N days, keystroke prediction is not enabled | Default value: 15                                            |
| keystroke.api.url                        | Keystroke Server API URL                                                                                                             | [https://1.1.1.1:5000/predict](https://1.1.1.1:5000/predict) |
| keystroke.username.threshold             | Username prediction success threshold. The prediction distance must be under the threshold.                                          | Default value: 0.5                                           |