---
title: Vault Threats
slug: kronpam-reference-guide-3-9-0/vault-threats
docTags: 
createdAt: 2026-10-11T11:26:53.516Z
---

The engine models the normal usage pattern of every Vault Account and of every user, and it returns a total risk score for each vault event.

To open the Vault Threats page:

1.      Log in to the Kron PAM Web GUI.

2.      Navigate to **Threat Analytics** > **Vault Threats**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/63HT8qfjjLkLt81raYVr6_image.png "Figure - Vault Threats Dashboard")

The summary cards show the total vault event count, the number of users with anomalies, and the number of Vault Accounts with anomalies. The anomaly table lists the user name, the host, the account group, the account name, the event time, the risk severity, the total risk score, and the anomaly status of every vault anomaly.

Click the actions icon on an anomaly row to open the **Anomaly Options** menu:

·         Under **Vault Event**, users open **Risk Score Detail** to see the partial scores that make up the total risk score, or open **Vault Event Detail** to read the details of the vault event in text format.

·         **Mark as Not Anomaly** labels the event as a false positive and sends the feedback to the ML engine.

·         Under **Actions**, **Automated Actions** displays the actions that Kron PAM already took. Users run the remaining actions manually: **Send Notification**, **Revoke User Access**, **Kill Credential-Based Sessions**, **Cancel Reservation**, **Lock User**, and **Suspend User**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/AQW3xnGKFnpnqkGEnNJTA_image.png "Figure - Vault Anomaly Options Menu")

The **Anomaly Insights** section presents the same interactive overview for vault events. Users adjust the time range to see how the anomaly count changes day by day and how the anomalies spread across anomaly types and vault actions.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/7Ag7NhGXZbFtSbRZtnPT__image.png "Figure - Anomaly Insights on the Vault Threats Page")

The **Severity Configurations** tab holds a threshold table for user anomalies and a threshold table for account anomalies. Click the edit icon on a row to change the threshold value or the automatic actions.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/TE-pHE0uQp2ljv8rj8ooZ_image.png "Figure - Vault Threats Severity Configurations")