Vault Threats
The engine models the normal usage pattern of every Vault Account and of every user, and it returns a total risk score for each vault event.
To open the Vault Threats page:
1. Log in to the Kron PAM Web GUI.
2. Navigate to Threat Analytics > Vault Threats.
The summary cards show the total vault event count, the number of users with anomalies, and the number of Vault Accounts with anomalies. The anomaly table lists the user name, the host, the account group, the account name, the event time, the risk severity, the total risk score, and the anomaly status of every vault anomaly.
Click the actions icon on an anomaly row to open the Anomaly Options menu:
· Under Vault Event, users open Risk Score Detail to see the partial scores that make up the total risk score, or open Vault Event Detail to read the details of the vault event in text format.
· Mark as Not Anomaly labels the event as a false positive and sends the feedback to the ML engine.
· Under Actions, Automated Actions displays the actions that Kron PAM already took. Users run the remaining actions manually: Send Notification, Revoke User Access, Kill Credential-Based Sessions, Cancel Reservation, Lock User, and Suspend User.
The Anomaly Insights section presents the same interactive overview for vault events. Users adjust the time range to see how the anomaly count changes day by day and how the anomalies spread across anomaly types and vault actions.
The Severity Configurations tab holds a threshold table for user anomalies and a threshold table for account anomalies. Click the edit icon on a row to change the threshold value or the automatic actions.
