Integrating PAM360 with AI for Intelligent Insights

PAM360 brings AI-driven capabilities that help administrators quickly analyze key activity patterns and identify potential risks associated with privileged access. By offering AI capabilities for critical functions, PAM360 helps reduce manual effort, improve access governance, and adapt to evolving security demands across diverse environments. This document outlines the detailed steps to integrate PAM360 with AI providers (BYOK) or self-hosted LLMs (BYO-LLM), and leverage their capabilities to generate intelligent insights that enhance privileged access management. It covers the following topics:

1. Roles and Permissions
2. Supported Capabilities
3. Integration Steps

1. Roles and Permissions

By default, users with the administrator type user role can manage AI integrations and generate AI insights for the supported functionalities in PAM360. Additionally, PAM360 allows administrators to configure custom user roles with the following privileges to manage the AI integrations and generate AI insights using the integrated AI platform:

• Manage AI Integrations - Navigate to Admin >> Customization >> Roles >> Add Role >> AI-Powered Insights, and enable the custom role Manage AI Integrations. Enabling this privilege will allow the users to enable, manage, and disable AI integrations with PAM360.
• Generate AI Insights - Navigate to Admin >> Customization >> Roles >> Add Role >> AI-Powered Insights, and enable the custom role Generate AI Insights. Enabling this privilege will allow the users to generate AI insights for the supported functionalities.
  

2. Supported Capabilities

PAM360 integrates with AI providers or self-hosted LLMs to offer intelligent insights into various aspects of privileged access management. Through AI integration, administrators can generate summaries of recorded privileged sessions to review user activities and identify security-relevant actions, obtain AWS IAM policy recommendations based on identity usage to enforce least-privilege access, and review policy remediation summaries to understand how removing excessive permissions can mitigate security risks.

The integration offers the following AI capabilities to enhance privileged access management through contextual decision-making:

• AI Summaries for Recorded Sessions
• Risk Remediation for Cloud Entitlements

2.1 AI Summaries for Recorded Sessions

PAM360 leverages integrated AI models to generate summaries of recorded RDP, Legacy SSH, and Telnet sessions. These summaries provide an overview of user activity during privileged sessions.

• Recorded SSH and Telnet Sessions - The AI model provides a user activity summary that includes authentication, executed commands, file access, configuration changes, system navigation, sudo operations, database operations, and session termination. The summaries highlight the user actions, providing administrators a record of privileged session activity for auditing and forensic investigation.
• Recorded RDP Sessions - The AI model analyzes Windows session events and process information to generate a user activity summary that includes authentication, privilege elevation, admin tools launched, application access, process and services management, system configuration changes, registry edits, software installation and removal, user account changes, potential data transfer activities identified from the recorded events, etc. These insights help administrators identify sensitive operations and review privileged access activities during security audits and investigations.

Explore this link for more details about generating session summaries for recorded sessions using AI.

2.2 Risk Remediation for Cloud Entitlements

In cloud environments, where identities are often assigned excessive privileges, PAM360 integrates with AI models to provide intelligent insights to remediate the risks associated with cloud identities. AI models generate IAM policy suggestions and policy remediation summaries for excessive privilege risks associated with AWS identities. In addition to PAM360's built-in policy recommendations, these AI capabilities help administrators identify unused permissions, evaluate least-privilege policy recommendations, and understand how the suggested changes can reduce security risks associated with cloud identities.

2.2.i AI-Based IAM Policy Suggestion

PAM360 leverages integrated AI models to generate IAM policy suggestions for AWS identities with excessive privileges. The AI model analyzes the identity's currently attached IAM policy and its recorded AWS usage to generate a recommended policy in JSON format. The suggested policy retains only the permissions that are present in the existing policy and have been used by the identity, while restricting resource access to the resources defined in the existing policy that were actually accessed.

These AI-generated policy suggestions help administrators identify and remove unused permissions, enabling them to implement least-privilege access policies and reduce the attack surface associated with excessive privileges.

2.2.ii AI-Generated Policy Remediation Summary

PAM360 also allows administrators to generate AI-based policy remediation summaries by comparing an identity's currently attached AWS IAM policy with the suggested IAM policy. The summary identifies the specific permissions removed from the existing policy and explains how the suggested policy addresses excessive privilege risks, highlighting how the proposed IAM policy can minimize the attack surface, reduce the risk of accidental misuse or data exposure, and limit opportunities for lateral movement. The summary also provides administrators with a clearer understanding of the permission changes, facilitating policy reviews and troubleshooting.

Explore this link for more details about generating AI-based IAM policy suggestions and policy remediation summaries to address excessive privilege risks associated with AWS identities.

3. Integration Steps

PAM360 supports integration with the following AI providers (BYOK) or self-hosted LLMs (BYO-LLM):

• AI Providers: OpenAI, Microsoft Azure OpenAI Service, Anthropic, Google AI, DeepSeek, and SiliconFlow
• Self-Hosted LLMs: Phi-3, Mistral AI, LLaMA, Qwen, and Others (i.e., any LLMs that support OpenAI-compatible API standards)

3.1 Integrating AI Providers with PAM360

Follow these steps to integrate the desired AI providers with PAM360 to unlock AI-powered insights across various functionalities within the application:

1. Navigate to Admin >> Integrations >> AI-Powered Insights.
2. On the AI-Powered Insights page, under the AI Provider section, click the Enable button below the desired AI provider.
3. In the configuration slider that appears, enter the following details:
   1. Enterprise API Key - Enter the API key generated on the AI provider website.

      Additional Detail

      AI integrations in PAM360 can be enabled by configuring enterprise API keys obtained from the respective platforms.

   2. AI Model - Choose the enterprise-licensed model from the available options to generate intelligent insights. Model marked with a star icon is recommended based on our internal evaluation and observed performance.
      
   3. Select the specific AI-powered functionalities you want to enable in PAM360 within the supported Cloud Entitlements and Remote Sessions modules.
      1. Cloud Entitlements
         • Policy Suggestion - Enable this check box to use the AI model to generate recommended policy suggestions for an excessive privilege risk associated with a cloud identity.

           Additional Detail

           The currently attached policy and identity usage behavior of the selected identity will be analyzed by AI model to suggest a least-privilege policy.

         • Policy Remediation Summary - Enable this check box to generate a policy remediation summary for an excessive privilege risk associated with an identity.

           Additional Detail

           The selected AI model compares the previously attached and currently suggested AWS inline policies to summarize key differences and highlight how excessive privileges are remediated to ensure that only just enough permissions are granted.

      2. Remote Sessions
         • Recorded Legacy SSH Session Summary - Enable this checkbox to use the selected AI model to generate a summary for recorded legacy SSH sessions.
         • Recorded Telnet Session Summary - Enable this checkbox to use the selected AI model to generate a summary for recorded Telnet sessions.
         • Recorded Windows Events Session Summary - Enable this checkbox to use the selected AI model to generate a summary for recorded RDP sessions.

         Caution

         The recordings may include system events, user inputs, outputs, keystrokes, and actions performed by the user, which will be analyzed by the AI model to generate an insightful summary.

4. After entering the required details, click Test to verify communication between PAM360 and the AI provider.
5. Upon successful test result, click Enable to integrate the AI provider with PAM360 successfully.
6. On the AI Terms of Use page that appears, read and approve the terms and conditions and click the Agree button to integrate the AI provider with PAM360 for the selected features.
   

You have successfully integrated an AI provider with PAM360 to generate intelligent insights for your preferred features. After integration, you can edit the configuration at any time, disable the integration, or replace it with a new AI provider or self-hosted LLM directly from the AI-Powered Insights page.

3.2 Integrating Self-Hosted LLMs with PAM360

Follow these steps to integrate your self-hosted LLM with PAM360 to unlock AI-powered insights across various functionalities within the application:

1. Navigate to Admin >> Integrations >> AI-Powered Insights.
2. On the AI-Powered Insights page, under the Self-Hosted LLM section, click Enable below the desired LLM. If your organization’s hosted LLM is not listed, select Enable under Others.
   
3. In the configuration slider that appears, enter the following details:
   1. AI Provider Name - If you selected Others, enter the name of the AI provider.
   2. LLM Endpoint URL - Enter the HTTPS endpoint URL where the LLM is hosted and ensure that the HTTPS certificate is imported into the PAM360 server. For more details on importing the certificate, refer to Question 11 in this document.

      Caution

      PAM360 only supports HTTPS-based communication. Ensure that your LLM endpoint is configured to use HTTPS before providing the URL.

   3. AI Model - Choose the AI model from the available options to generate intelligent insights. Model marked with a star icon is recommended based on our internal evaluation and observed performance.
      
   4. Model Name - If you selected Others, enter the AI model name.
   5. API Key - Enter the API key generated on the self-hosted LLM server.
   6. Select the specific AI-powered functionalities you want to enable in PAM360 within the supported Cloud Entitlements and Remote Sessions modules.
      1. Cloud Entitlements
         • Policy Suggestion - Enable this check box to use the AI model to generate recommended policy suggestions for an excessive privilege risk associated with a cloud identity.

           Additional Detail

           The currently attached policy and identity usage behavior of the selected identity will be analyzed by AI model to suggest a least-privilege policy.

         • Policy Remediation Summary - Enable this check box to generate a policy remediation summary for an excessive privilege risk associated with an identity.

           Additional Detail

           The selected AI model compares the previously attached and currently suggested AWS inline policies to summarize key differences and highlight how excessive privileges are remediated to ensure that only just enough permissions are granted.

      2. Remote Sessions
         • Recorded Legacy SSH Session Summary - Enable this checkbox to use the selected AI model to generate a summary for recorded legacy SSH sessions.
         • Recorded Telnet Session Summary - Enable this checkbox to use the selected AI model to generate a summary for recorded Telnet sessions.
         • Recorded Windows Events Session Summary - Enable this checkbox to use the selected AI model to generate a summary for recorded RDP sessions.

         Caution

         The recordings may include system events, user inputs, outputs, keystrokes, and actions performed by the user, which will be analyzed by the AI model to generate an insightful summary.

4. After entering the required details, click Test to verify communication between PAM360 and the LLM endpoint.
5. Upon successful test result, click Enable to integrate the self-hosted LLM with PAM360 successfully.
6. On the AI Terms of Use page that appears, read and approve the terms and conditions and click the Agree button to integrate the self-hosted LLM with PAM360 for the selected features.
   

You have successfully integrated a self-hosted LLM with PAM360 to generate intelligent insights for your preferred features. After integration, you can edit the configuration at any time, disable the integration, or replace it with a new self-hosted LLM or AI provider directly from the AI-Powered Insights page.