Detected Risk Scores
The calculated risk scores are determined using machine learning algorithms, considering various parameters such as the user initiating the session, session duration, actions performed during the session, client IP address, and host IP address. This calculation is not based on a static rule; instead, it takes into account historical data related to the user and the connected device to identify any anomalies in the user's current records.
In each session and for every operation performed within the session, a risk score is computed to identify anomalies or abnormal situations. A total risk score is calculated for the user and the device according to the weight values determined in the Threat Analytics and Response Engine configuration. This total risk score is classified according to low, medium, high, and critical levels according to the thresholds determined on Kron PAM.