What counts as an activity
An activity is any single, observable event produced by a user interacting with a workstation. Activities are recorded within user activity monitoring. Individual activities are small and concrete, and most fall into six types:
| Type | What it covers |
|---|---|
| Application activities | A program launched, brought forward, or actively used |
| Web activities | A URL visited, a search query, time spent on a site |
| File activities | A file opened, renamed, copied, printed, moved, or deleted |
| Communication activities | An email, a message, or a file transfer in a messaging app |
| Device activities | A USB drive connected, a clipboard paste, a print job |
| Time-tracking activities | Active and idle periods, used to rebuild the working day |
How activities are recorded
Each recorded activity typically carries metadata: the user, the host, the timestamp, the duration, and the object involved, such as an application name, a URL, a file path, or a device identifier. Sometimes it also includes the classification of the data that was touched.
Activities are captured by a monitoring agent installed on the endpoint. Granularity varies by deployment: some record only metadata, while others also capture content such as screenshots or keystrokes. The path of a single record:
- 1
Observe
The agent watches operating-system events, such as process starts, network requests, and file-system operations.
- 2
Enrich
The event becomes a record with the user, host, timestamp, duration, and object.
- 3
Store
Enriched records are written to a central store.
- 4
Manage
There they can be filtered, aggregated, and retained according to policy.
Activities on a user's timeline
The Daily activity tab spreads a user's activities over an hourly grid, with a counter beside each type icon.
What activity data is used for
Activity timelines help reveal insider threats. Activity data serves four main purposes:
| Use | What it gives |
|---|---|
| Security investigation | A timeline of what a user did around an incident |
| Behavioral analysis | A baseline of normal behavior, with deviations flagged |
| Productivity analysis | Working-time reports by user, team, or department |
| Compliance evidence | An audit trail showing who accessed what, and when |
How it looks in Anexet
These views come from the Anexet Activity module.
1 / 4
Activities, events, and logs
The vocabulary overlaps. "Activity" usually refers to a user-facing record that is meaningful to a human reviewer. "Event" is the low-level system signal, and a "log" is the stored, searchable collection of many events.
Further reading: Profiling.
Activity, event, and log are three words for stages of one pipeline: capture, enrich, store, and analyze.
Anexet TeamHow Anexet handles this
The Anexet Activity module records user activities through endpoint agents deployed across Windows, Linux, and macOS workstations, and turns them into security and productivity intelligence:
Activity capture
application usage and foreground duration, websites and search queries, file operations, email and messaging activity, clipboard events, printing, USB device connections, and active/idle time.
Real-time User Profile dashboard
a customizable per-employee view showing incidents and latest events, productivity metrics, summary analytics, active processes, and connected devices, updated in real time, with quick navigation to the underlying events. Detailed per-user reports are generated from the same view.
Productivity analytics
working-time visualization, productivity charts, and top applications and websites per user, team, or department.
Audit trail
every recorded activity keeps its metadata (user, timestamp, object, duration), supporting investigation and regulatory evidence requirements.
On-premise storage
activity data remains on the customer's own infrastructure, a deliberate design choice, since monitoring data is itself sensitive.
Anexet Activity module
Learn more