Behavior Violations By Employee
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
Leo Stiles
Lisa Holt
Maria Bennett
Martin Sutherland
Michael Redmond
Michelle Hurley
Mindy Jameson
Mohamed Krogh
Patsy Smith
Raphael Dantes
Seth McGregor
Shelby Hunter
Shiyam Morcos
Simon Woodly
Tamar Loya
Thomas Cook
Tia Sanders
Tim Farrow
Tim Farrow (MAC)
Vivian De Paul
020406080100120140160180
Actions Resulting from Policy Violations
BlockNoneNotifyWarn
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
Leo Stiles
Lisa Holt
Maria Bennett
Martin Sutherland
Michael Redmond
Michelle Hurley
Mindy Jameson
Mohamed Krogh
Patsy Smith
Raphael Dantes
Seth McGregor
Shelby Hunter
Shiyam Morcos
Simon Woodly
Tamar Loya
Thomas Cook
Tia Sanders
Tim Farrow
Tim Farrow (MAC)
Vivian De Paul
020406080100120140160180
Employee AI Use 1
Aymon Cousteau
Demie Slappendel
Seth McGregor
Ellis Hart
Brayden Crawford
Michael Redmond
Raphael Dantes
Jackson Gollan
Simon Woodly
Kate Sparrow
Thomas Cook
Mindy Jameson
Leo Stiles
Fang Shen
James Gabbert
Donald Jurickova
Cheryl Guillen
Lisa Holt
Kevin Wainright
Mohamed Krogh
Tamar Loya
Dustin Miller
Martin Sutherland
Vivian De Paul
Tia Sanders
Ian Fransson
Leo Gross
Shelby Hunter
Elinor Silva
Shiyam Morcos
Tim Farrow
0s1h2h3h4h5h
Employee Risk Heatmap
Rule Violations by Risk
T1083 File and Directory D...
T1016.001 System Networ...
Detect OpenClaw Agent Act...
T1016 System Network Con...
T1048.001 Exfiltration Over...
Clipboard
Block File Upload to AI Chat
Delete from File share
Download from File share
T1007 System Service Dis...
Detect OpenClaw Comman...
Email file from File Share
Renaming within the File S...
Screenshot in fileshare
Checking Code with AI
Detect AI-Native Browser ...
Using an application for X ...
Emailing PHI to External Email
Rename Downloaded File
Unusual Access - Marketi...
Block external drives
Block Malicious Application
Unauthorized Data Access...
Pasting text that contains p...
TBG003 Copying Multiple ...
T1124 System Time Discovery
T1082 System Information ...
Prevent RDP file transfers
Connecting unlisted USB d...
Email contains SSN
Exfiltration Over Web Servi...
TBG007 Threats of Violence
Block Credit Card Sharing ...
T1057 Process Discovery
OCR Payroll exposure via ...
T1053.002 Scheduled Task...
Accessing Streaming Sites
Job search websites
T1049 System Network C...
Detect Shadow AI Applicati...
T1070.004 Indicator Remov...
PII: Social Security Number...
Resignation Intent via AI Tools
TBG008 Classified Docum...
Workplace Toxicity
T1059.003 Command and ...
050100150200250300350
Web File Events
Web DownloadWeb Upload
Behavior Alerts
| Employee ? | Timestamp | Action | Rule | Description | Triggers | |
|---|---|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:35:40 AM | Warn | T1082 System Information Discovery | Used the application systeminfo.exe. | ||
| Raphael Dantes | 2026-07-12 09:35:40 AM | Warn | T1124 System Time Discovery | Used the application systeminfo.exe. | ||
| Raphael Dantes | 2026-07-12 09:38:38 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | ||
| Raphael Dantes | 2026-07-12 09:38:56 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | ||
| Raphael Dantes | 2026-07-12 02:04:10 PM | Notify | TBG007 Threats of Violence | Typed "...h demonstrates strong fundamentals supported by active ecops" in soffice.bin. | ||
| Raphael Dantes | 2026-07-12 04:34:24 PM | Notify | TBG007 Threats of Violence | Typed " threat" in soffice.bin. | ||
| Raphael Dantes | 2026-07-12 04:38:59 PM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\token fundamental analysis report.odt on drive C:. | ||
| Raphael Dantes | 2026-07-12 04:39:00 PM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\lu130020u3cue6.tmp on drive C:. | ||
| Raphael Dantes | 2026-07-12 04:39:06 PM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# on drive C:. | ||
| Raphael Dantes | 2026-07-12 04:44:42 PM | Warn | T1057 Process Discovery | Used the application tasklist.exe. | ||
| Raphael Dantes | 2026-07-12 04:44:42 PM | Warn | T1083 File and Directory Discovery | Used the application find.exe. | ||
| Tim Farrow | 2026-07-12 09:15:49 AM | Warn | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application ping.exe. | ||
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | ||
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\lu112792tf475f.tmp on drive C:. | ||
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.pdf on drive C:. | ||
| Mohamed Krogh | 2026-07-12 08:23:19 AM | Warn | T1016 System Network Configuration Discovery | Used the application arp.exe. | ||
| Mohamed Krogh | 2026-07-12 08:54:58 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\.~lock.healthcare business report.odp# on drive C:. | ||
| Mindy Jameson | 2026-07-12 02:14:39 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client effectiveness.zip on drive C:. | ||
| Mindy Jameson | 2026-07-12 04:18:28 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\downloads\dmo brochure.zip on drive C:. | ||
| Mindy Jameson | 2026-07-12 05:18:54 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | ||
| Mindy Jameson | 2026-07-12 05:18:55 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\lu9476tfb9wp.tmp on drive C:. | ||
| Mindy Jameson | 2026-07-12 05:20:04 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.pdf on drive C:. | ||
| Mindy Jameson | 2026-07-12 07:15:17 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client communication effectiveness.zip~rf3866fd39.tmp on drive C:. | ||
| Mindy Jameson | 2026-07-12 08:57:27 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\.~lock.health plan enrollment list.ods# on drive C:. | ||
| Ellis Hart | 2026-07-12 01:04:32 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\ehart\tsallusr.dat on drive C:. |
All Events
| Employee ? | Timestamp | Event type | Event description | |
|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:35:40 AM | Alert | Violated rule T1082 System Information Discovery: Used the application systeminfo.exe. | |
| Raphael Dantes | 2026-07-12 09:35:40 AM | Alert | Violated rule T1124 System Time Discovery: Used the application systeminfo.exe. | |
| Raphael Dantes | 2026-07-12 09:38:38 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | |
| Raphael Dantes | 2026-07-12 09:38:56 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | |
| Raphael Dantes | 2026-07-12 02:04:10 PM | Alert | Violated rule TBG007 Threats of Violence: Typed "...h demonstrates strong fundamentals supported by active ecops" in soffice.bin. | |
| Raphael Dantes | 2026-07-12 04:34:24 PM | Alert | Violated rule TBG007 Threats of Violence: Typed " threat" in soffice.bin. | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\token fundamental analysis report.odt on drive C:. | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\lu130020u3cue6.tmp on drive C:. | |
| Raphael Dantes | 2026-07-12 04:39:06 PM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# on drive C:. | |
| Raphael Dantes | 2026-07-12 04:44:42 PM | Alert | Violated rule T1057 Process Discovery: Used the application tasklist.exe. | |
| Raphael Dantes | 2026-07-12 04:44:42 PM | Alert | Violated rule T1083 File and Directory Discovery: Used the application find.exe. | |
| Tim Farrow | 2026-07-12 09:15:49 AM | Alert | Violated rule T1016.001 System Network Configuration Discovery: Internet Connection Discovery: Used the application ping.exe. | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\lu112792tf475f.tmp on drive C:. | |
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\healthcare business report.pdf on drive C:. | |
| Mohamed Krogh | 2026-07-12 08:23:19 AM | Alert | Violated rule T1016 System Network Configuration Discovery: Used the application arp.exe. | |
| Mohamed Krogh | 2026-07-12 08:54:58 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\.~lock.healthcare business report.odp# on drive C:. | |
| Mindy Jameson | 2026-07-12 02:14:39 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\client effectiveness.zip on drive C:. | |
| Mindy Jameson | 2026-07-12 04:18:28 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\downloads\dmo brochure.zip on drive C:. | |
| Mindy Jameson | 2026-07-12 05:18:54 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | |
| Mindy Jameson | 2026-07-12 05:18:55 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\lu9476tfb9wp.tmp on drive C:. | |
| Mindy Jameson | 2026-07-12 05:20:04 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\health plan enrollment list.pdf on drive C:. | |
| Mindy Jameson | 2026-07-12 07:15:17 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\client communication effectiveness.zip~rf3866fd39.tmp on drive C:. | |
| Mindy Jameson | 2026-07-12 08:57:27 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\.~lock.health plan enrollment list.ods# on drive C:. | |
| Ellis Hart | 2026-07-12 01:04:32 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\ehart\tsallusr.dat on drive C:. | |
| Demie Slappendel | 2026-07-12 10:20:33 AM | Received email from [email protected] to [email protected] | ||
| Gordon Lewis | 2026-07-12 09:58:12 AM | Received email from [email protected] to [email protected] | ||
| Brayden Crawford | 2026-07-12 08:41:08 AM | Received email from [email protected] to [email protected] | ||
| Kate Sparrow | 2026-07-12 08:10:25 AM | Received email from [email protected] to [email protected] |
Rule Violations
| Employee ? | Timestamp ↑ | Action | Risk | Rule | Description | |
|---|---|---|---|---|---|---|
| Tamar Loya | 2026-07-17 12:34:44 AM | Warn | 0 | Pasting text that contains predefined sensitive keywords | Text copied dear donald, i hope you are doing well. as part of ou.... | |
| Martin Sutherland | 2026-07-17 12:35:08 AM | Warn | 0 | Pasting text that contains predefined sensitive keywords | Text copied dear donald, i hope you are doing well. as part of ou.... | |
| Seth McGregor | 2026-07-17 12:35:12 AM | Warn | 0 | Pasting text that contains predefined sensitive keywords | Text copied dear donald, i hope you are doing well. as part of ou.... | |
| Tia Sanders | 2026-07-17 01:00:49 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\tsanders\tsallusr.dat on drive C:. | |
| Aymon Cousteau | 2026-07-17 01:01:53 AM | Warn | 2 | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application pathping.exe. | |
| Cheryl Guillen | 2026-07-17 01:02:08 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\cguillen\tsallusr.dat on drive C:. | |
| Chadwick Singh | 2026-07-17 01:02:14 AM | Warn | 2 | T1016 System Network Configuration Discovery | Used the application ipconfig.exe. | |
| Tia Sanders | 2026-07-17 01:03:19 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\tsanders\tsallusr.dat on drive C:. | |
| Ellis Hart | 2026-07-17 01:04:32 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\ehart\tsallusr.dat on drive C:. | |
| Cheryl Guillen | 2026-07-17 01:04:39 AM | None | 0 | T1053.002 Scheduled Task/Job: At (Windows) | Used the application netstat.exe. | |
| Cheryl Guillen | 2026-07-17 01:04:39 AM | Warn | 0 | T1049 System Network Connections Discovery | Used the application netstat.exe. | |
| Jackson Gollan | 2026-07-17 01:05:19 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\jgollan\tsallusr.dat on drive C:. | |
| Michael Redmond | 2026-07-17 01:06:17 AM | Warn | 0 | T1082 System Information Discovery | Used the application systeminfo.exe. | |
| Michael Redmond | 2026-07-17 01:06:17 AM | Warn | 0 | T1124 System Time Discovery | Used the application systeminfo.exe. | |
| Fang Shen | 2026-07-17 01:43:29 AM | Warn | 2 | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application ping.exe. | |
| Fang Shen | 2026-07-17 02:04:07 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\fshen\documents\business project.pdf on drive C:. | |
| Mindy Jameson | 2026-07-17 02:14:39 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client effectiveness.zip on drive C:. | |
| Aymon Cousteau | 2026-07-17 02:21:45 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\acousteau\downloads\iphone.oxps on drive C:. | |
| Michelle Hurley | 2026-07-17 02:34:02 AM | Warn | 0 | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mhurley\documents\charlotte.oxps on drive C:. |
Behavior Violations By Employee
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
Leo Stiles
Lisa Holt
Maria Bennett
Martin Sutherland
Michael Redmond
Michelle Hurley
Mindy Jameson
Mohamed Krogh
Patsy Smith
Raphael Dantes
Seth McGregor
Shelby Hunter
Shiyam Morcos
Simon Woodly
Tamar Loya
Thomas Cook
Tia Sanders
Tim Farrow
Tim Farrow (MAC)
Vivian De Paul
020406080100120140160180
Actions against Activities
Warn
Notify
Block
None
02004006008001000
Hours When Actions are Taken
Policy Enforcement by Employee
BlockNoneNotifyWarn
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
Leo Stiles
Lisa Holt
Maria Bennett
Martin Sutherland
Michael Redmond
Michelle Hurley
Mindy Jameson
Mohamed Krogh
Patsy Smith
Raphael Dantes
Seth McGregor
Shelby Hunter
Shiyam Morcos
Simon Woodly
Tamar Loya
Thomas Cook
Tia Sanders
Tim Farrow
Tim Farrow (MAC)
Vivian De Paul
020406080100120140160180
Rule Violations
| Employee ? | Date | Timestamp ↑ | Policy | Rule | |
|---|---|---|---|---|---|
| Tamar Loya | 2026-07-17 | 12:34:44 AM | Compliance Rules | Pasting text that contains predefined sensitive keywords | |
| Martin Sutherland | 2026-07-17 | 12:35:08 AM | Compliance Rules | Pasting text that contains predefined sensitive keywords | |
| Seth McGregor | 2026-07-17 | 12:35:12 AM | Compliance Rules | Pasting text that contains predefined sensitive keywords | |
| Tia Sanders | 2026-07-17 | 01:00:49 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Aymon Cousteau | 2026-07-17 | 01:01:53 AM | TA0007 Discovery | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | |
| Cheryl Guillen | 2026-07-17 | 01:02:08 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Chadwick Singh | 2026-07-17 | 01:02:14 AM | TA0007 Discovery | T1016 System Network Configuration Discovery | |
| Tia Sanders | 2026-07-17 | 01:03:19 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Ellis Hart | 2026-07-17 | 01:04:32 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Cheryl Guillen | 2026-07-17 | 01:04:39 AM | TA0002 Execution | T1053.002 Scheduled Task/Job: At (Windows) | |
| Cheryl Guillen | 2026-07-17 | 01:04:39 AM | TA0007 Discovery | T1049 System Network Connections Discovery | |
| Jackson Gollan | 2026-07-17 | 01:05:19 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Michael Redmond | 2026-07-17 | 01:06:17 AM | TA0007 Discovery | T1082 System Information Discovery | |
| Michael Redmond | 2026-07-17 | 01:06:17 AM | TA0007 Discovery | T1124 System Time Discovery | |
| Fang Shen | 2026-07-17 | 01:43:29 AM | TA0007 Discovery | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | |
| Fang Shen | 2026-07-17 | 02:04:07 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Mindy Jameson | 2026-07-17 | 02:14:39 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Aymon Cousteau | 2026-07-17 | 02:21:45 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | |
| Michelle Hurley | 2026-07-17 | 02:34:02 AM | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion |
All Events Data
| Employee ? | Timestamp | Event type | Event description | |
|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:35:40 AM | Alert | Violated rule T1082 System Information Discovery: Used the application systeminfo.exe. | |
| Raphael Dantes | 2026-07-12 09:35:40 AM | Alert | Violated rule T1124 System Time Discovery: Used the application systeminfo.exe. | |
| Raphael Dantes | 2026-07-12 09:38:38 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | |
| Raphael Dantes | 2026-07-12 09:38:56 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | |
| Raphael Dantes | 2026-07-12 02:04:10 PM | Alert | Violated rule TBG007 Threats of Violence: Typed "...h demonstrates strong fundamentals supported by active ecops" in soffice.bin. | |
| Raphael Dantes | 2026-07-12 04:34:24 PM | Alert | Violated rule TBG007 Threats of Violence: Typed " threat" in soffice.bin. | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\token fundamental analysis report.odt on drive C:. | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\lu130020u3cue6.tmp on drive C:. | |
| Raphael Dantes | 2026-07-12 04:39:06 PM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# on drive C:. | |
| Raphael Dantes | 2026-07-12 04:44:42 PM | Alert | Violated rule T1057 Process Discovery: Used the application tasklist.exe. | |
| Raphael Dantes | 2026-07-12 04:44:42 PM | Alert | Violated rule T1083 File and Directory Discovery: Used the application find.exe. | |
| Tim Farrow | 2026-07-12 09:15:49 AM | Alert | Violated rule T1016.001 System Network Configuration Discovery: Internet Connection Discovery: Used the application ping.exe. | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\lu112792tf475f.tmp on drive C:. | |
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\healthcare business report.pdf on drive C:. | |
| Mohamed Krogh | 2026-07-12 08:23:19 AM | Alert | Violated rule T1016 System Network Configuration Discovery: Used the application arp.exe. | |
| Mohamed Krogh | 2026-07-12 08:54:58 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mkrogh\documents\.~lock.healthcare business report.odp# on drive C:. | |
| Mindy Jameson | 2026-07-12 02:14:39 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\client effectiveness.zip on drive C:. | |
| Mindy Jameson | 2026-07-12 04:18:28 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\downloads\dmo brochure.zip on drive C:. | |
| Mindy Jameson | 2026-07-12 05:18:54 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | |
| Mindy Jameson | 2026-07-12 05:18:55 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\lu9476tfb9wp.tmp on drive C:. | |
| Mindy Jameson | 2026-07-12 05:20:04 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\health plan enrollment list.pdf on drive C:. | |
| Mindy Jameson | 2026-07-12 07:15:17 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\client communication effectiveness.zip~rf3866fd39.tmp on drive C:. | |
| Mindy Jameson | 2026-07-12 08:57:27 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\mwatson\documents\.~lock.health plan enrollment list.ods# on drive C:. | |
| Ellis Hart | 2026-07-12 01:04:32 AM | Alert | Violated rule T1070.004 Indicator Removal on Host: File Deletion: Deleted path c:\users\ehart\tsallusr.dat on drive C:. | |
| Demie Slappendel | 2026-07-12 10:20:33 AM | Received email from [email protected] to [email protected] | ||
| Gordon Lewis | 2026-07-12 09:58:12 AM | Received email from [email protected] to [email protected] | ||
| Brayden Crawford | 2026-07-12 08:41:08 AM | Received email from [email protected] to [email protected] | ||
| Kate Sparrow | 2026-07-12 08:10:25 AM | Received email from [email protected] to [email protected] |
Keystrokes Data
| Employee ? | Timestamp | App / Domain | Keystroke | |
|---|---|---|---|---|
| Shelby Hunter | 2026-07-17 09:38:56 AM | ms-teams.exe | <Backspace>,<Space>and<Space>achieve<Space>lasting<Space>success<Space>together<Space><Enter> | |
| Kate Sparrow | 2026-07-17 09:32:04 AM | x.com | <CapsLock>T<CapsLock>rust<Space>the<Space>process<Space>a<Space>little<Space>longer | |
| Kevin Wainright | 2026-07-17 09:31:34 AM | windowsterminal.exe | Get-ChildItem<Space>-Recurse<Space>C:\Finance\Q4<Enter> | |
| Lisa Holt | 2026-07-17 09:24:50 AM | mail.google.com | <CapsLock>T<CapsLock>hank<Space><CapsLock>Y<CapsLock>ou<Space>for<Space><CapsLock>Y<CapsLock>our<Space><CapsLock>S<CapsLock>u;pp<Backspace><Backspace><Backspace>pport<Tab><Enter> | |
| Simon Woodly | 2026-07-17 09:24:28 AM | soffice.bin | ation<Space>and<Space>professionalism<Space>are<Space>greatly<Space>appre<Tab>.<Enter> | |
| Leo Gross | 2026-07-17 09:24:15 AM | decrypt.co | staking<Space>rewards<Space>calculator<Enter> | |
| James Gabbert | 2026-07-17 09:23:55 AM | cryptonews.net | btc<Space>etf<Space>inflows<Enter> | |
| Dustin Miller | 2026-07-17 09:18:44 AM | x.com | <CapsLock>S<CapsLock>mall<Space>steps<Space>every<Space>day<Space>add<Space>up |
Emails Data
| Employee ? | Timestamp | Direction | Source | |
|---|---|---|---|---|
| Demie Slappendel | 2026-07-17 09:37:55 AM | Incoming | [email protected] | |
| Gordon Lewis | 2026-07-17 09:30:15 AM | Incoming | [email protected] | |
| Brayden Crawford | 2026-07-17 09:30:00 AM | Outgoing | [email protected] | |
| Kate Sparrow | 2026-07-17 09:20:36 AM | Outgoing | [email protected] | |
| Leo Gross | 2026-07-17 09:20:10 AM | Incoming | [email protected] | |
| Patsy Smith | 2026-07-17 09:16:01 AM | Incoming | [email protected] | |
| Mindy Jameson | 2026-07-17 09:15:31 AM | Outgoing | [email protected] | |
| Tia Sanders | 2026-07-17 09:07:52 AM | Incoming | [email protected] |
File Events by Employee
AccessCopyCreateRemoveRenameWrite
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee (Ubuntu)
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
Leo Stiles
Lisa Holt
Maria Bennett
Martin Sutherland
Michael Redmond
Michelle Hurley
Mindy Jameson
Mohamed Krogh
Patsy Smith
Raphael Dantes
Seth McGregor
Shelby Hunter
Shiyam Morcos
Simon Woodly
Tamar Loya
Thomas Cook
Tia Sanders
Tim Farrow (MAC)
Vivian De Paul
0100200300400500600700800
Web File Events by Employee
Web DownloadWeb Upload
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
04K8K12K16K20K24K28K
Outgoing Emails with Attachments
File Events over Time
AccessCopyCreateRemoveRenameWrite
File Event Details
| Employee | Timestamp | Event type | Description | File name | |
|---|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:38:38 AM | Remove | Remove c:\users\rdantes\documents\data privacy awareness survey.oxps | data privacy awareness survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:39 AM | Write | Write c:\users\rdantes\documents\data privacy awareness survey.oxps | data privacy awareness survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:56 AM | Remove | Remove c:\users\rdantes\documents\joint venture feedback survey.oxps | joint venture feedback survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:58 AM | Write | Write c:\users\rdantes\documents\joint venture feedback survey.oxps | joint venture feedback survey.oxps | |
| Raphael Dantes | 2026-07-12 01:35:15 PM | Access | Access c:\program files\libreoffice\share\extensions\dict-en\package-description.txt | package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:15 PM | Access | Access c:\program files\libreoffice\share\extensions\dict-fr\package-description.txt | package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:16 PM | Access | Access c:\program files\libreoffice\share\extensions\dict-es\package-description.txt | package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:20 PM | Access | Access c:\program files\libreoffice\share\config\images_colibre.zip | images_colibre.zip | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Remove | Remove c:\users\rdantes\documents\token fundamental analysis report.odt | token fundamental analysis report.odt | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Write | Write c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# | .~lock.token fundamental analysis report.odt# | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Write | Write c:\users\rdantes\documents\lu130020u3cue6.tmp | lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Copy | Copy c:\users\rdantes\documents\lu130020u3cue6.tmp to c:\users\rdantes\documents\token fundamental analysis report.odt | token fundamental analysis report.odt, lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Remove | Remove c:\users\rdantes\documents\lu130020u3cue6.tmp | lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:06 PM | Remove | Remove c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# | .~lock.token fundamental analysis report.odt# | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\extensions\dict-en\package-description.txt | package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\extensions\dict-fr\package-description.txt | package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\extensions\dict-es\package-description.txt | package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | Access c:\program files\libreoffice\share\config\images_colibre.zip | images_colibre.zip | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Remove | Remove c:\users\mkrogh\documents\healthcare business report.odp | healthcare business report.odp | |
| Mohamed Krogh | 2026-07-12 04:42:27 AM | Write | Write c:\users\mkrogh\documents\lu112792tf475f.tmp | lu112792tf475f.tmp | |
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Remove | Remove c:\users\mkrogh\documents\healthcare business report.pdf | healthcare business report.pdf | |
| Mindy Jameson | 2026-07-12 05:18:54 AM | Remove | Remove c:\users\mwatson\documents\health plan enrollment list.ods | health plan enrollment list.ods | |
| Mindy Jameson | 2026-07-12 05:18:55 AM | Write | Write c:\users\mwatson\documents\lu9476tfb9wp.tmp | lu9476tfb9wp.tmp | |
| Mindy Jameson | 2026-07-12 05:20:04 AM | Remove | Remove c:\users\mwatson\documents\health plan enrollment list.pdf | health plan enrollment list.pdf |
All File Events for Review
| Employee | Timestamp | Event type | File name | Description | |
|---|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:38:38 AM | Remove | data privacy awareness survey.oxps | Remove c:\users\rdantes\documents\data privacy awareness survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:39 AM | Write | data privacy awareness survey.oxps | Write c:\users\rdantes\documents\data privacy awareness survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:56 AM | Remove | joint venture feedback survey.oxps | Remove c:\users\rdantes\documents\joint venture feedback survey.oxps | |
| Raphael Dantes | 2026-07-12 09:38:58 AM | Write | joint venture feedback survey.oxps | Write c:\users\rdantes\documents\joint venture feedback survey.oxps | |
| Raphael Dantes | 2026-07-12 01:35:15 PM | Access | package-description.txt | Access c:\program files\libreoffice\share\extensions\dict-en\package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:15 PM | Access | package-description.txt | Access c:\program files\libreoffice\share\extensions\dict-fr\package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:16 PM | Access | package-description.txt | Access c:\program files\libreoffice\share\extensions\dict-es\package-description.txt | |
| Raphael Dantes | 2026-07-12 01:35:20 PM | Access | images_colibre.zip | Access c:\program files\libreoffice\share\config\images_colibre.zip | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Remove | token fundamental analysis report.odt | Remove c:\users\rdantes\documents\token fundamental analysis report.odt | |
| Raphael Dantes | 2026-07-12 04:38:59 PM | Write | .~lock.token fundamental analysis report.odt# | Write c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Write | lu130020u3cue6.tmp | Write c:\users\rdantes\documents\lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Copy | token fundamental analysis report.odt, lu130020u3cue6.tmp | Copy c:\users\rdantes\documents\lu130020u3cue6.tmp to c:\users\rdantes\documents\token fundamental analysis report.odt | |
| Raphael Dantes | 2026-07-12 04:39:00 PM | Remove | lu130020u3cue6.tmp | Remove c:\users\rdantes\documents\lu130020u3cue6.tmp | |
| Raphael Dantes | 2026-07-12 04:39:06 PM | Remove | .~lock.token fundamental analysis report.odt# | Remove c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | package-description.txt | Access c:\program files\libreoffice\share\extensions\dict-en\package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | package-description.txt | Access c:\program files\libreoffice\share\extensions\dict-fr\package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | package-description.txt | Access c:\program files\libreoffice\share\extensions\dict-es\package-description.txt | |
| Mohamed Krogh | 2026-07-12 02:16:40 AM | Access | images_colibre.zip | Access c:\program files\libreoffice\share\config\images_colibre.zip | |
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Remove | healthcare business report.odp | Remove c:\users\mkrogh\documents\healthcare business report.odp | |
| Mohamed Krogh | 2026-07-12 04:42:27 AM | Write | lu112792tf475f.tmp | Write c:\users\mkrogh\documents\lu112792tf475f.tmp | |
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Remove | healthcare business report.pdf | Remove c:\users\mkrogh\documents\healthcare business report.pdf | |
| Mindy Jameson | 2026-07-12 05:18:54 AM | Remove | health plan enrollment list.ods | Remove c:\users\mwatson\documents\health plan enrollment list.ods | |
| Mindy Jameson | 2026-07-12 05:18:55 AM | Write | lu9476tfb9wp.tmp | Write c:\users\mwatson\documents\lu9476tfb9wp.tmp | |
| Mindy Jameson | 2026-07-12 05:20:04 AM | Remove | health plan enrollment list.pdf | Remove c:\users\mwatson\documents\health plan enrollment list.pdf |
Online Employees
| Employee | Work time | Idle Time | Current activity | Location | Active/Idle time | Activity Chart | |
|---|---|---|---|---|---|---|---|
| James OC Demo | 14h 55m | 14h 25m | Windows Explorer | United States / Washington | 3% | ||
| James Gabbert | 5h 56m | 1h 20m | cryptonews.net | Germany / Frankfurt | 78% | ||
| Simon Woodly | 5h 55m | 1h 30m | mail.yahoo.com | Germany / Frankfurt | 75% | ||
| Kate Sparrow | 5h 55m | 2h 5m | x.com | Germany / Frankfurt | 65% | ||
| Lisa Holt | 5h 57m | 1h 25m | LibreOffice | Germany / Frankfurt | 76% | ||
| Tim Farrow | 5h 56m | 1h 30m | Slack | Germany / Frankfurt | 75% | ||
| Dustin Miller | 5h 56m | 1h 40m | x.com | Germany / Frankfurt | 72% | ||
| Kevin Wainright | 5h 56m | 1h 25m | Windows Command Processor | Germany / Frankfurt | 76% | ||
| Denis Lee (Ubuntu) | 5h 54m | 1h 30m | docs.google.com | - | 75% | ||
| Leo Gross | 5h 54m | 2h 10m | decrypt.co | Germany / Frankfurt | 64% | ||
| Maria Bennett | 1h 53m | 0h 40m | Google Chrome | Germany / Frankfurt | 65% | ||
| Vivian De Paul | 5h 56m | 1h 25m | Zoom Meetings | Germany / Frankfurt | 76% | ||
| Leo Stiles | 5h 56m | 0h 50m | crypto.com | Germany / Frankfurt | 86% | ||
| Raphael Dantes | 5h 56m | 0h 55m | drive.google.com | Germany / Frankfurt | 85% |
Online Employees
| Employee | Work time | Current activity | Location | Active/Idle time | Activity Chart | |
|---|---|---|---|---|---|---|
| James OC Demo | 14h 55m | Windows Explorer | United States / Washington | 3% | ||
| James Gabbert | 5h 56m | cryptonews.net | Germany / Frankfurt | 78% | ||
| Simon Woodly | 5h 55m | mail.yahoo.com | Germany / Frankfurt | 75% | ||
| Kate Sparrow | 5h 55m | x.com | Germany / Frankfurt | 65% | ||
| Lisa Holt | 5h 57m | LibreOffice | Germany / Frankfurt | 76% | ||
| Tim Farrow | 5h 56m | Slack | Germany / Frankfurt | 75% | ||
| Dustin Miller | 5h 56m | x.com | Germany / Frankfurt | 72% | ||
| Kevin Wainright | 5h 56m | Windows Command Processor | Germany / Frankfurt | 76% | ||
| Denis Lee (Ubuntu) | 5h 54m | docs.google.com | - | 75% | ||
| Leo Gross | 5h 54m | decrypt.co | Germany / Frankfurt | 64% | ||
| Maria Bennett | 1h 53m | Google Chrome | Germany / Frankfurt | 65% | ||
| Vivian De Paul | 5h 56m | Zoom Meetings | Germany / Frankfurt | 76% | ||
| Leo Stiles | 5h 56m | crypto.com | Germany / Frankfurt | 86% | ||
| Raphael Dantes | 5h 56m | drive.google.com | Germany / Frankfurt | 85% |
Live Montage
Live Montage
Employees Engagement
James OC Demo
Denis Lee
Tim Farrow
Brayden Crawford
Gordon Lewis
Patsy Smith
Demie Slappendel
Donald Jurickova
Shiyam Morcos
Michelle Hurley
Elinor Silva
Shelby Hunter
Tamar Loya
Martin Sutherland
Cheryl Guillen
Tia Sanders
Ellis Hart
Ian Fransson
Simon Woodly
Leo Gross
Vivian De Paul
Kate Sparrow
Seth McGregor
Raphael Dantes
Leo Stiles
Dustin Miller
Jackson Gollan
Chadwick Singh
Kevin Wainright
Mohamed Krogh
Mindy Jameson
James Gabbert
Lisa Holt
Tim Farrow (MAC)
Fang Shen
Thomas Cook
Denis Lee (Ubuntu)
Aymon Cousteau
Michael Redmond
Ethan Stafford
Maria Bennett
0%2%4%6%8%10%12%14%16%18%
Non-Work Related Time
Work Related Time
Leo Gross
James Gabbert
Simon Woodly
Mohamed Krogh
Mindy Jameson
Kate Sparrow
Gordon Lewis
Raphael Dantes
Demie Slappendel
Tamar Loya
Cheryl Guillen
Ellis Hart
Patsy Smith
Shelby Hunter
Donald Jurickova
Tia Sanders
Ian Fransson
Shiyam Morcos
Elinor Silva
Seth McGregor
Vivian De Paul
Michael Redmond
Kevin Wainright
Martin Sutherland
Lisa Holt
Fang Shen
Michelle Hurley
Dustin Miller
Jackson Gollan
Leo Stiles
Thomas Cook
Brayden Crawford
Chadwick Singh
James OC Demo
Ethan Stafford
Maria Bennett
0s10h20h30h40h50h
Productivity Trends
Productive timeUnproductive TimeUnclassified Time
Rules Broken
T1070.004 Indicator Removal o…
T1016.001 System Network Conf…
TBG003 Copying Multiple Files…
T1016 System Network Connecti…
Detect OpenClaw Agent Activity
T1083 File and Directory Disc…
T1057 Process Discovery
Block Credit Card Sharing
Detect AI-Native Browser Usage
Pasting text that contains PII
02004006008001000
Rule Breakers
Leo Stiles
Dustin Miller
Kevin Wainright
Ethan Stafford
Mindy Jameson
Lisa Holt
Tim Farrow (MAC)
Leo Gross
James Gabbert
Martin Sutherland
050100150200
Actions Taken
Warn
Notify
Block
None
02004006008001000
Policy Violation Trends
AI UsageCompliance RulesFile System RulesInsider RiskSample PolicyTA0002 ExecutionTA0005 Defense EvasionTA0007 DiscoveryTA0010 ExfiltrationUnproductive Behavior Rules
Actions Taken
Warn
Notify
Block
None
02004006008001000
App/Site Usage by Count
x.com
mail.google.com
docs.google.com
ms-teams.exe
slack.com
drive.google.com
chrome.exe
quote.cnbc.com
www.linkedin.com
mail.yahoo.com
decrypt.co
crypto.com
0100200300400
App/Site Users
Engagement By Employee
Engagement Heatmap
Events by Employee
| Employee | Timestamp | App / Domain | Time | URL | |
|---|---|---|---|---|---|
| James Gabbert | 2026-07-17 09:46:22 AM | www.trading.com | 00:04:12 | https://www.trading.com/markets/overview | |
| Simon Woodly | 2026-07-17 09:39:12 AM | x.com | 00:02:41 | https://x.com/home | |
| Kate Sparrow | 2026-07-17 09:38:38 AM | x.com | 00:01:58 | https://x.com/notifications | |
| Lisa Holt | 2026-07-17 09:38:07 AM | outlook.live.com | 00:06:05 | https://outlook.live.com/mail/0/inbox | |
| Tim Farrow | 2026-07-17 09:29:24 AM | mail.google.com | 00:03:34 | https://mail.google.com/mail/u/0/#inbox | |
| Dustin Miller | 2026-07-17 09:28:58 AM | ms-teams.exe | 00:11:27 | ||
| Kevin Wainright | 2026-07-17 09:28:43 AM | ms-teams.exe | 00:08:03 | ||
| Leo Gross | 2026-07-17 09:23:28 AM | decrypt.co | 00:02:19 | https://decrypt.co/price/bitcoin | |
| Vivian De Paul | 2026-07-17 09:23:16 AM | zoom.exe | 00:26:44 |
Low to High Engagement
James OC Demo
Denis Lee
Tim Farrow
Brayden Crawford
Gordon Lewis
Patsy Smith
Demie Slappendel
Donald Jurickova
Shiyam Morcos
Michelle Hurley
Elinor Silva
Shelby Hunter
Tamar Loya
Martin Sutherland
Cheryl Guillen
Tia Sanders
Ellis Hart
Ian Fransson
Simon Woodly
Leo Gross
Vivian De Paul
Kate Sparrow
Seth McGregor
Raphael Dantes
Leo Stiles
Dustin Miller
Jackson Gollan
Chadwick Singh
Kevin Wainright
Mohamed Krogh
Mindy Jameson
James Gabbert
Lisa Holt
Tim Farrow (MAC)
Fang Shen
Thomas Cook
Denis Lee (Ubuntu)
Aymon Cousteau
Michael Redmond
Ethan Stafford
Maria Bennett
0%2%4%6%8%10%12%14%16%18%
Work Time
Leo Gross
James Gabbert
Simon Woodly
Mohamed Krogh
Mindy Jameson
Kate Sparrow
Gordon Lewis
Raphael Dantes
Demie Slappendel
Tamar Loya
Cheryl Guillen
Ellis Hart
Patsy Smith
Shelby Hunter
Donald Jurickova
Tia Sanders
Ian Fransson
Shiyam Morcos
Elinor Silva
Seth McGregor
Vivian De Paul
Michael Redmond
Kevin Wainright
Martin Sutherland
Lisa Holt
Fang Shen
Michelle Hurley
Dustin Miller
Jackson Gollan
Leo Stiles
Thomas Cook
Brayden Crawford
Chadwick Singh
James OC Demo
Ethan Stafford
Maria Bennett
0s30h60h90h120h150h
Spend
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
05001K1.5K2K
Work Related Time
Non-Work Related Time
Idle Time
Unproductive Idle TimeUnclassified Idle TimeProductive Idle Time
Session Data
| Employee | Date | Time | Active time | Idle Time | Productive Time (%) | Unproductive Time (%) | Unclassified Time (%) | |
|---|---|---|---|---|---|---|---|---|
| Fang Shen | 2026-07-12 | 08:03:54 | 07:53:38 | 00:10:16 | 50.65% | 43.19% | 6.04% | |
| Kevin Wainright | 2026-07-12 | 08:01:36 | 07:49:17 | 00:12:19 | 5.92% | 94.03% | 0.02% | |
| Elinor Silva | 2026-07-12 | 07:26:08 | 06:46:24 | 00:39:44 | 75.25% | 24.75% | 0.00% | |
| Martin Sutherland | 2026-07-12 | 08:01:50 | 07:38:48 | 00:23:02 | 29.82% | 62.22% | 0.00% | |
| Vivian De Paul | 2026-07-12 | 07:53:37 | 07:52:03 | 00:01:34 | 64.35% | 35.65% | 0.00% | |
| Ethan Stafford | 2026-07-12 | 02:35:10 | 02:35:10 | 00:00:00 | 98.78% | 0.00% | 0.43% | |
| Maria Bennett | 2026-07-12 | 02:28:17 | 02:28:17 | 00:00:00 | 94.91% | 0.00% | 2.79% | |
| Mindy Jameson | 2026-07-12 | 08:07:25 | 07:50:31 | 00:16:54 | 73.49% | 21.07% | 1.01% | |
| Donald Jurickova | 2026-07-12 | 08:03:19 | 07:35:48 | 00:27:31 | 52.59% | 38.29% | 7.35% | |
| Chadwick Singh | 2026-07-12 | 07:57:50 | 07:27:26 | 00:30:24 | 13.68% | 86.04% | 0.28% | |
| Dustin Miller | 2026-07-12 | 07:58:52 | 07:34:15 | 00:24:37 | 24.26% | 57.91% | 0.00% |
Online Employees
| Employee | Work time | Idle Time | Current activity | Location | Active/Idle time | Activity Chart | |
|---|---|---|---|---|---|---|---|
| James OC Demo | 14h 55m | 14h 25m | Windows Explorer | United States / Washington | 3% | ||
| James Gabbert | 5h 56m | 1h 20m | cryptonews.net | Germany / Frankfurt | 78% | ||
| Simon Woodly | 5h 55m | 1h 30m | mail.yahoo.com | Germany / Frankfurt | 75% | ||
| Kate Sparrow | 5h 55m | 2h 5m | x.com | Germany / Frankfurt | 65% | ||
| Lisa Holt | 5h 57m | 1h 25m | LibreOffice | Germany / Frankfurt | 76% | ||
| Tim Farrow | 5h 56m | 1h 30m | Slack | Germany / Frankfurt | 75% | ||
| Dustin Miller | 5h 56m | 1h 40m | x.com | Germany / Frankfurt | 72% | ||
| Kevin Wainright | 5h 56m | 1h 25m | Windows Command Processor | Germany / Frankfurt | 76% | ||
| Denis Lee (Ubuntu) | 5h 54m | 1h 30m | docs.google.com | - | 75% | ||
| Leo Gross | 5h 54m | 2h 10m | decrypt.co | Germany / Frankfurt | 64% | ||
| Maria Bennett | 1h 53m | 0h 40m | Google Chrome | Germany / Frankfurt | 65% | ||
| Vivian De Paul | 5h 56m | 1h 25m | Zoom Meetings | Germany / Frankfurt | 76% | ||
| Leo Stiles | 5h 56m | 0h 50m | crypto.com | Germany / Frankfurt | 86% | ||
| Raphael Dantes | 5h 56m | 0h 55m | drive.google.com | Germany / Frankfurt | 85% |
Logged Work Time
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
0s10h20h30h40h50h
Non-Work Related Time
Actions Taken
Warn
Notify
Block
None
02004006008001000
Rules Broken
T1070.004 Indicator Removal o…
T1016.001 System Network Conf…
TBG003 Copying Multiple Files…
T1016 System Network Connecti…
Detect OpenClaw Agent Activity
T1083 File and Directory Disc…
T1057 Process Discovery
Block Credit Card Sharing
Detect AI-Native Browser Usage
Pasting text that contains PII
02004006008001000
Unproductive Behavior Rules
Behavior Alerts
| Employee ? | Timestamp | Action | Rule | Description | Triggers | |
|---|---|---|---|---|---|---|
| Raphael Dantes | 2026-07-12 09:35:40 AM | Warn | T1082 System Information Discovery | Used the application systeminfo.exe. | ||
| Raphael Dantes | 2026-07-12 09:35:40 AM | Warn | T1124 System Time Discovery | Used the application systeminfo.exe. | ||
| Raphael Dantes | 2026-07-12 09:38:38 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | ||
| Raphael Dantes | 2026-07-12 09:38:56 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | ||
| Raphael Dantes | 2026-07-12 02:04:10 PM | Notify | TBG007 Threats of Violence | Typed "...h demonstrates strong fundamentals supported by active ecops" in soffice.bin. | ||
| Raphael Dantes | 2026-07-12 04:34:24 PM | Notify | TBG007 Threats of Violence | Typed " threat" in soffice.bin. | ||
| Raphael Dantes | 2026-07-12 04:38:59 PM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\token fundamental analysis report.odt on drive C:. | ||
| Raphael Dantes | 2026-07-12 04:39:00 PM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\lu130020u3cue6.tmp on drive C:. | ||
| Raphael Dantes | 2026-07-12 04:39:06 PM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\.~lock.token fundamental analysis report.odt# on drive C:. | ||
| Raphael Dantes | 2026-07-12 04:44:42 PM | Warn | T1057 Process Discovery | Used the application tasklist.exe. | ||
| Raphael Dantes | 2026-07-12 04:44:42 PM | Warn | T1083 File and Directory Discovery | Used the application find.exe. | ||
| Tim Farrow | 2026-07-12 09:15:49 AM | Warn | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application ping.exe. | ||
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | ||
| Mohamed Krogh | 2026-07-12 04:42:26 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\lu112792tf475f.tmp on drive C:. | ||
| Mohamed Krogh | 2026-07-12 04:44:13 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.pdf on drive C:. | ||
| Mohamed Krogh | 2026-07-12 08:23:19 AM | Warn | T1016 System Network Configuration Discovery | Used the application arp.exe. | ||
| Mohamed Krogh | 2026-07-12 08:54:58 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\.~lock.healthcare business report.odp# on drive C:. | ||
| Mindy Jameson | 2026-07-12 02:14:39 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client effectiveness.zip on drive C:. | ||
| Mindy Jameson | 2026-07-12 04:18:28 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\downloads\dmo brochure.zip on drive C:. | ||
| Mindy Jameson | 2026-07-12 05:18:54 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | ||
| Mindy Jameson | 2026-07-12 05:18:55 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\lu9476tfb9wp.tmp on drive C:. | ||
| Mindy Jameson | 2026-07-12 05:20:04 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.pdf on drive C:. | ||
| Mindy Jameson | 2026-07-12 07:15:17 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\client communication effectiveness.zip~rf3866fd39.tmp on drive C:. | ||
| Mindy Jameson | 2026-07-12 08:57:27 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\.~lock.health plan enrollment list.ods# on drive C:. | ||
| Ellis Hart | 2026-07-12 01:04:32 AM | Warn | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\ehart\tsallusr.dat on drive C:. |
Session Data
| Employee | Date | Time | Active time | Idle Time | Productive Time (%) | Unproductive Time (%) | Unclassified Time (%) | |
|---|---|---|---|---|---|---|---|---|
| Jackson Gollan | 2026-07-12 | 07:41:22 | 07:12:09 | 00:29:13 | 61.44% | 31.20% | 7.36% | |
| Jackson Gollan | 2026-07-12 | 08:02:47 | 07:48:30 | 00:14:17 | 58.02% | 39.71% | 2.27% | |
| Denis Lee (Ubuntu) | 2026-07-12 | 07:12:05 | 06:58:40 | 00:13:25 | 71.15% | 26.63% | 2.22% | |
| Tim Farrow (MAC) | 2026-07-12 | 06:48:31 | 06:20:12 | 00:28:19 | 66.98% | 30.14% | 2.88% |
Logged Work Time
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
0s10h20h30h40h50h
Employees Engagement
James OC Demo
Denis Lee
Tim Farrow
Brayden Crawford
Gordon Lewis
Patsy Smith
Demie Slappendel
Donald Jurickova
Shiyam Morcos
Michelle Hurley
Elinor Silva
Shelby Hunter
Tamar Loya
Martin Sutherland
Cheryl Guillen
Tia Sanders
Ellis Hart
Ian Fransson
Simon Woodly
Leo Gross
Vivian De Paul
Kate Sparrow
Seth McGregor
Raphael Dantes
Leo Stiles
Dustin Miller
Jackson Gollan
Chadwick Singh
Kevin Wainright
Mohamed Krogh
Mindy Jameson
James Gabbert
Lisa Holt
Tim Farrow (MAC)
Fang Shen
Thomas Cook
Denis Lee (Ubuntu)
Aymon Cousteau
Michael Redmond
Ethan Stafford
Maria Bennett
0%2%4%6%8%10%12%14%16%18%
Employees Engagement
James OC Demo
Denis Lee
Tim Farrow
Brayden Crawford
Gordon Lewis
Patsy Smith
Demie Slappendel
Donald Jurickova
Shiyam Morcos
Michelle Hurley
Elinor Silva
Shelby Hunter
Tamar Loya
Martin Sutherland
Cheryl Guillen
Tia Sanders
Ellis Hart
Ian Fransson
Simon Woodly
Leo Gross
Vivian De Paul
Kate Sparrow
Seth McGregor
Raphael Dantes
Leo Stiles
Dustin Miller
Jackson Gollan
Chadwick Singh
Kevin Wainright
Mohamed Krogh
Mindy Jameson
James Gabbert
Lisa Holt
Tim Farrow (MAC)
Fang Shen
Thomas Cook
Denis Lee (Ubuntu)
Aymon Cousteau
Michael Redmond
Ethan Stafford
Maria Bennett
0%2%4%6%8%10%12%14%16%18%
Work Related Time
Leo Gross
James Gabbert
Simon Woodly
Mohamed Krogh
Mindy Jameson
Kate Sparrow
Gordon Lewis
Raphael Dantes
Demie Slappendel
Tamar Loya
Cheryl Guillen
Ellis Hart
Patsy Smith
Shelby Hunter
Donald Jurickova
Tia Sanders
Ian Fransson
Shiyam Morcos
Elinor Silva
Seth McGregor
Vivian De Paul
Michael Redmond
Kevin Wainright
Martin Sutherland
Lisa Holt
Fang Shen
Michelle Hurley
Dustin Miller
Jackson Gollan
Leo Stiles
Thomas Cook
Brayden Crawford
Chadwick Singh
James OC Demo
Ethan Stafford
Maria Bennett
0s10h20h30h40h50h
Rule Breakers
Leo Stiles
Dustin Miller
Kevin Wainright
Ethan Stafford
Mindy Jameson
Lisa Holt
Tim Farrow (MAC)
Leo Gross
James Gabbert
Martin Sutherland
050100150200
Engagement Heatmap
Online Employees
| Employee | Work time | Idle Time | Current activity | Location | Active/Idle time | Activity Chart | |
|---|---|---|---|---|---|---|---|
| James OC Demo | 14h 55m | 14h 25m | Windows Explorer | United States / Washington | 3% | ||
| James Gabbert | 5h 56m | 1h 20m | cryptonews.net | Germany / Frankfurt | 78% | ||
| Simon Woodly | 5h 55m | 1h 30m | mail.yahoo.com | Germany / Frankfurt | 75% | ||
| Kate Sparrow | 5h 55m | 2h 5m | x.com | Germany / Frankfurt | 65% | ||
| Lisa Holt | 5h 57m | 1h 25m | LibreOffice | Germany / Frankfurt | 76% | ||
| Tim Farrow | 5h 56m | 1h 30m | Slack | Germany / Frankfurt | 75% | ||
| Dustin Miller | 5h 56m | 1h 40m | x.com | Germany / Frankfurt | 72% | ||
| Kevin Wainright | 5h 56m | 1h 25m | Windows Command Processor | Germany / Frankfurt | 76% | ||
| Denis Lee (Ubuntu) | 5h 54m | 1h 30m | docs.google.com | - | 75% | ||
| Leo Gross | 5h 54m | 2h 10m | decrypt.co | Germany / Frankfurt | 64% | ||
| Maria Bennett | 1h 53m | 0h 40m | Google Chrome | Germany / Frankfurt | 65% | ||
| Vivian De Paul | 5h 56m | 1h 25m | Zoom Meetings | Germany / Frankfurt | 76% | ||
| Leo Stiles | 5h 56m | 0h 50m | crypto.com | Germany / Frankfurt | 86% | ||
| Raphael Dantes | 5h 56m | 0h 55m | drive.google.com | Germany / Frankfurt | 85% |
Live Montage
Logged Work Time
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
0s10h20h30h40h50h
Non-Work Related Time
Avg productive time by office
Frankfurt
Washington
Lisbon
Remote
0h2h4h6h
Avg idle time by office
Frankfurt
Washington
Lisbon
Remote
0h1h2h
Office Comparison
| Office | Employees | Avg work time | Avg productive time | Avg idle time | Engagement |
|---|---|---|---|---|---|
| Frankfurt | 24 | 7h 41m | 5h 12m | 1h 6m | 14.2% |
| Washington | 8 | 7h 22m | 4h 48m | 1h 24m | 12.8% |
| Lisbon | 5 | 7h 05m | 4h 24m | 1h 36m | 11.4% |
| Remote | 4 | 6h 47m | 4h 06m | 1h 48m | 10.1% |
Employees Engagement
James OC Demo
Denis Lee
Tim Farrow
Brayden Crawford
Gordon Lewis
Patsy Smith
Demie Slappendel
Donald Jurickova
Shiyam Morcos
Michelle Hurley
Elinor Silva
Shelby Hunter
Tamar Loya
Martin Sutherland
Cheryl Guillen
Tia Sanders
Ellis Hart
Ian Fransson
Simon Woodly
Leo Gross
Vivian De Paul
Kate Sparrow
Seth McGregor
Raphael Dantes
Leo Stiles
Dustin Miller
Jackson Gollan
Chadwick Singh
Kevin Wainright
Mohamed Krogh
Mindy Jameson
James Gabbert
Lisa Holt
Tim Farrow (MAC)
Fang Shen
Thomas Cook
Denis Lee (Ubuntu)
Aymon Cousteau
Michael Redmond
Ethan Stafford
Maria Bennett
0%2%4%6%8%10%12%14%16%18%
Logged Work Time
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
0s10h20h30h40h50h
Spend
Aymon Cousteau
Brayden Crawford
Chadwick Singh
Cheryl Guillen
Demie Slappendel
Denis Lee
Donald Jurickova
Dustin Miller
Elinor Silva
Ellis Hart
Ethan Stafford
Fang Shen
Gordon Lewis
Ian Fransson
Jackson Gollan
James Gabbert
James OC Demo
Kate Sparrow
Kevin Wainright
Leo Gross
05001K1.5K2K
Productivity Trends
Productive timeUnproductive TimeUnclassified Time