Risk Score Timeline
Alerts Timeline
Top Risky Employees
Ethan Stafford
Lisa Holt
Patsy Smith
Demie Slappendel
Kevin Wainright
Tia Sanders
Gordon Lewis
James Gabbert
James OC Demo
Dustin Miller
050100150
Top Risky Departments
Sales
Helpdesk Department
Compliance
Marketing
IT
Departing Employees
No Department
Managers
External Contractors
050100150200
Behavior Alerts by Severity
T1070.004 Indicator Rem…
T1016.001 System Networ…
TBG003 Copying Multiple…
T1016 System Network Co…
Detect OpenClaw Agent A…
T1083 File and Director…
T1057 Process Discovery
Block Credit Card Shari…
Detect AI-Native Browse…
Pasting text that conta…
02004006008001000
Review Behavior Alerts
| Timestamp | Department ? | Policy | Rule | Description | Action | Employee | |
|---|---|---|---|---|---|---|---|
| 2026-07-17 09:44:05 AM | Helpdesk Depar… | TA0007 Discovery | T1082 System Informatio… | Used the application systeminfo.exe. | Warn | Raphael Dantes | |
| 2026-07-17 09:41:16 AM | Sales | TA0007 Discovery | T1124 System Time Disco… | Used the application systeminfo.exe. | Warn | Raphael Dantes | |
| 2026-07-17 09:40:56 AM | Sales | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | Warn | Raphael Dantes | |
| 2026-07-17 09:38:51 AM | Sales | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | Warn | Raphael Dantes | |
| 2026-07-17 09:38:13 AM | Marketing | TA0007 Discovery | T1016.001 System Networ… | Used the application ping.exe. | Warn | Tim Farrow | |
| 2026-07-17 09:37:42 AM | Marketing | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | Warn | Mohamed Krogh | |
| 2026-07-17 09:37:29 AM | Marketing | TA0007 Discovery | T1016 System Network Co… | Used the application arp.exe. | Warn | Mohamed Krogh | |
| 2026-07-17 09:36:00 AM | IT | TA0007 Discovery | T1083 File and Director… | Used the application find.exe. | Warn | Mohamed Krogh | |
| 2026-07-17 09:35:32 AM | IT | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | Warn | Mindy Jameson | |
| 2026-07-17 09:35:27 AM | Compliance | TA0007 Discovery | T1057 Process Discovery | Used the application tasklist.exe. | Warn | Donald Jurickova | |
| 2026-07-17 09:35:27 AM | Sales | Data Loss Prevention | Pasting text that conta… | Pasted content matching credit card pattern in outlook.live.com. | Warn | Fang Shen | |
| 2026-07-17 09:31:30 AM | Departing Empl… | TA0010 Exfiltration | TBG003 Copying Multiple… | Copied 214 files to external drive E:. | Warn | Thomas Cook | |
| 2026-07-17 09:31:30 AM | Helpdesk Depar… | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | Warn | Mohamed Krogh | |
| 2026-07-17 09:30:14 AM | Sales | TA0007 Discovery | T1082 System Informatio… | Used the application systeminfo.exe. | Warn | Raphael Dantes | |
| 2026-07-17 09:29:50 AM | Sales | TA0007 Discovery | T1083 File and Director… | Used the application find.exe. | Warn | Mohamed Krogh | |
| 2026-07-17 09:29:31 AM | Sales | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | Warn | Raphael Dantes | |
| 2026-07-17 09:28:50 AM | Marketing | TA0007 Discovery | T1057 Process Discovery | Used the application tasklist.exe. | Warn | Donald Jurickova | |
| 2026-07-17 09:23:26 AM | Marketing | TA0007 Discovery | T1016.001 System Networ… | Used the application ping.exe. | Warn | Tim Farrow | |
| 2026-07-17 09:23:26 AM | Marketing | TA0010 Exfiltration | TBG003 Copying Multiple… | Copied 214 files to external drive E:. | Warn | Thomas Cook | |
| 2026-07-17 09:23:02 AM | IT | TA0007 Discovery | T1016 System Network Co… | Used the application arp.exe. | Warn | Mohamed Krogh | |
| 2026-07-17 09:22:43 AM | IT | TA0007 Discovery | T1124 System Time Disco… | Used the application systeminfo.exe. | Warn | Raphael Dantes | |
| 2026-07-17 09:14:20 AM | Compliance | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | Warn | Mindy Jameson | |
| 2026-07-17 09:14:12 AM | Sales | TA0005 Defense Evasion | T1070.004 Indicator Rem… | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | Warn | Raphael Dantes | |
| 2026-07-17 09:06:51 AM | Departing Empl… | Data Loss Prevention | Pasting text that conta… | Pasted content matching credit card pattern in outlook.live.com. | Warn | Fang Shen |
Top Employees by Alert Count
Leo Stiles
Seth McGregor
Ethan Stafford
Mindy Jameson
James Gabbert
Leo Gross
Michael Redmond
Mohamed Krogh
Tim Farrow (MAC)
Chadwick Singh
050100150200250300
Top Behavior Alerts
T1070.004 Indicator Rem…
T1016.001 System Networ…
TBG003 Copying Multiple…
T1016 System Network Co…
Detect OpenClaw Agent A…
T1083 File and Director…
T1057 Process Discovery
Block Credit Card Shari…
Detect AI-Native Browse…
Pasting text that conta…
02004006008001000
Behavior Alerts of High Risk Emplo…
T1070.004 Indicator Rem…
T1016.001 System Networ…
TBG003 Copying Multiple…
T1016 System Network Co…
Detect OpenClaw Agent A…
T1083 File and Director…
T1057 Process Discovery
Block Credit Card Shari…
Detect AI-Native Browse…
Pasting text that conta…
02004006008001000
Top Unproductive Employees
Avg unproductive timeAvg productive time
James OC Demo
Vivian De Paul
Tim Farrow (MAC)
Aymon Cousteau
Leo Stiles
Denis Lee (Ubuntu)
Martin Sutherland
Thomas Cook
Chadwick Singh
Tia Sanders
0s5h10h15h20h
Avg Employee Activity
| Employee ? | Total work time ? | Idle time: Work time ? | Avg activity (%) graph: Input activity chart |
|---|---|---|---|
| Raphael Dantes | 56h 28m | 01:18:37 | |
| Ian Fransson | 53h 6m | 00:54:50 | |
| Ethan Stafford | 16h 59m | 00:00:00 | |
| James OC Demo | 153h 8m | 150:11:20 | |
| Shiyam Morcos | 53h 11m | 01:38:00 | |
| Vivian De Paul | 55h 41m | 00:30:56 | |
| Elinor Silva | 53h 8m | 01:33:32 | |
| Kevin Wainright | 56h 51m | 03:08:51 | |
| Dustin Miller | 55h 53m | 02:47:56 | |
| Tim Farrow (MAC) | 38h 30m | 01:30:14 | |
| Seth McGregor | 53h 52m | 02:34:31 | |
| Martin Sutherland | 53h 47m | 03:04:15 |
Behavior Alerts
| Timestamp | Employee | Department | Computer | Policy | Rule | Description | |
|---|---|---|---|---|---|---|---|
| 2026-07-12 09:35:40 AM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0007 Discovery | T1082 System Information Discovery | Used the application systeminfo.exe. | |
| 2026-07-12 09:35:40 AM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0007 Discovery | T1124 System Time Discovery | Used the application systeminfo.exe. | |
| 2026-07-12 09:38:38 AM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | |
| 2026-07-12 09:38:56 AM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | |
| 2026-07-12 02:04:10 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | Compliance Rules | TBG007 Threats of Violence | Typed "...h demonstrates strong fundamentals supported by active ecops" in soffice.bin. | |
| 2026-07-12 04:34:24 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | Compliance Rules | TBG007 Threats of Violence | Typed " threat" in soffice.bin. | |
| 2026-07-12 04:38:59 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\token fundamental analysis report.odt on drive C:. | |
| 2026-07-12 04:39:00 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\lu130020u3cue6.tmp on drive C:. | |
| 2026-07-12 04:39:06 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# on drive C:. | |
| 2026-07-12 04:44:42 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0007 Discovery | T1057 Process Discovery | Used the application tasklist.exe. | |
| 2026-07-12 04:44:42 PM | Raphael Dantes | Helpdesk Department | win-035khor8tef | TA0007 Discovery | T1083 File and Directory Discovery | Used the application find.exe. | |
| 2026-07-12 09:15:49 AM | Tim Farrow | IT | win-035khor8tef | TA0007 Discovery | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application ping.exe. | |
| 2026-07-12 04:42:26 AM | Mohamed Krogh | Marketing | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | |
| 2026-07-12 04:42:26 AM | Mohamed Krogh | Marketing | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\lu112792tf475f.tmp on drive C:. | |
| 2026-07-12 04:44:13 AM | Mohamed Krogh | Marketing | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.pdf on drive C:. | |
| 2026-07-12 08:23:19 AM | Mohamed Krogh | Marketing | win-035khor8tef | TA0007 Discovery | T1016 System Network Configuration Discovery | Used the application arp.exe. | |
| 2026-07-12 08:54:58 AM | Mohamed Krogh | Marketing | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\.~lock.healthcare business report.odp# on drive C:. | |
| 2026-07-12 02:14:39 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client effectiveness.zip on drive C:. | |
| 2026-07-12 04:18:28 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\downloads\dmo brochure.zip on drive C:. | |
| 2026-07-12 05:18:54 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | |
| 2026-07-12 05:18:55 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\lu9476tfb9wp.tmp on drive C:. | |
| 2026-07-12 05:20:04 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.pdf on drive C:. | |
| 2026-07-12 07:15:17 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client communication effectiveness.zip~rf3866fd39.tmp on drive C:. | |
| 2026-07-12 08:57:27 AM | Mindy Jameson | Sales | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\.~lock.health plan enrollment list.ods# on drive C:. | |
| 2026-07-12 01:04:32 AM | Ellis Hart | IT | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\ehart\tsallusr.dat on drive C:. |
File Events by Employee
AccessCopyCreateRemoveRenameWrite
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee (Ubuntu)
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
Leo Stiles
Lisa Holt
Maria Bennett
Martin Sutherland
Michael Redmond
Michelle Hurley
Mindy Jameson
Mohamed Krogh
Patsy Smith
Raphael Dantes
Seth McGregor
Shelby Hunter
Shiyam Morcos
Simon Woodly
Tamar Loya
Thomas Cook
Tia Sanders
Tim Farrow (MAC)
Vivian De Paul
0100200300400500600700800
Web File Events by Employee
Web DownloadWeb Upload
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
05K10K15K20K25K30K35K
Outgoing Emails with Attachments
File Events Over Time
AccessCopyCreateRemoveRenameWrite
File Event Details
| Employee | Timestamp | Event type | Description | File name | |
|---|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:38:38 AM | Remove | Remove c:\users\rdantes\documents\data privacy awareness survey.oxps | data privacy awareness survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:39 AM | Write | Write c:\users\rdantes\documents\data privacy awareness survey.oxps | data privacy awareness survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:56 AM | Remove | Remove c:\users\rdantes\documents\joint venture feedback survey.oxps | joint venture feedback survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:58 AM | Write | Write c:\users\rdantes\documents\joint venture feedback survey.oxps | joint venture feedback survey.oxps | |
| Raphael Dantes | 2026-07-12 01:35:15 PM | Access | Access c:\program files\libreoffice\share\extensions\dict-en\package-description.txt | package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:15 PM | Access | Access c:\program files\libreoffice\share\extensions\dict-fr\package-description.txt | package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:16 PM | Access | Access c:\program files\libreoffice\share\extensions\dict-es\package-description.txt | package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:20 PM | Access | Access c:\program files\libreoffice\share\config\images_colibre.zip | images_colibre.zip | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Remove | Remove c:\users\rdantes\documents\token fundamental analysis report.odt | token fundamental analysis report.odt | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Write | Write c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# | .~lock.token fundamental analysis report.odt# | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Write | Write c:\users\rdantes\documents\lu130020u3cue6.tmp | lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Copy | Copy c:\users\rdantes\documents\lu130020u3cue6.tmp to c:\users\rdantes\documents\token fundamental analysis report.odt | token fundamental analysis report.odt, lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Remove | Remove c:\users\rdantes\documents\lu130020u3cue6.tmp | lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:06 PM | Remove | Remove c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# | .~lock.token fundamental analysis report.odt# | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\extensions\dict-en\package-description.txt | package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\extensions\dict-fr\package-description.txt | package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\extensions\dict-es\package-description.txt | package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\config\images_colibre.zip | images_colibre.zip | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Remove | Remove c:\users\mkrogh\documents\healthcare business report.odp | healthcare business report.odp | |
| Mohamed Krogh | 2026-07-12 04:42:27 AM | Write | Write c:\users\mkrogh\documents\lu112792tf475f.tmp | lu112792tf475f.tmp | |
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Remove | Remove c:\users\mkrogh\documents\healthcare business report.pdf | healthcare business report.pdf | |
| Mindy Jameson | 2026-07-12 05:18:54 AM | Remove | Remove c:\users\mwatson\documents\health plan enrollment list.ods | health plan enrollment list.ods | |
| Mindy Jameson | 2026-07-12 05:18:55 AM | Write | Write c:\users\mwatson\documents\lu9476tfb9wp.tmp | lu9476tfb9wp.tmp | |
| Mindy Jameson | 2026-07-12 05:20:04 AM | Remove | Remove c:\users\mwatson\documents\health plan enrollment list.pdf | health plan enrollment list.pdf |