Denis Lee
OfflineActive Behavior PoliciesAI Usage 6 TA0010 Exfiltration 1 File System Rules 2 See all applied policies →
Activity
Activity (Keyboard/Mouse) Hourly
Top Tasks Performed
Project Tasks
0s1h2h3h4h5h6h7h8h9h
| Timestamp ↓ | Computer ? | App / Domain | Time ? | Title | |
|---|---|---|---|---|---|
| 2026-07-17 09:49:32 AM | demo-ubuntu-ms-7b85 | slack.exe | 00:03:31 | Slack | #general | |
| 2026-07-17 09:46:48 AM | demo-ubuntu-ms-7b85 | soffice.bin | 00:18:09 | Q4-Forecast.ods - LibreOffice Calc | |
| 2026-07-17 09:46:48 AM | demo-ubuntu-ms-7b85 | windowsterminal.exe | 00:23:02 | Administrator: Windows PowerShell | |
| 2026-07-17 09:41:45 AM | demo-ubuntu-ms-7b85 | soffice.bin | 00:18:09 | Q4-Forecast.ods - LibreOffice Calc | |
| 2026-07-17 09:41:39 AM | demo-ubuntu-ms-7b85 | chat.google.com | 00:00:01 | Chat | |
| 2026-07-17 09:41:06 AM | demo-ubuntu-ms-7b85 | www.pinterest.com | 00:00:01 | Tasty Garlic Shrimp Gratin: Simple and Full of Flavor - Goo… | |
| 2026-07-17 09:41:06 AM | demo-ubuntu-ms-7b85 | ms-teams.exe | 00:12:44 | Weekly pipeline review | Microsoft Teams | |
| 2026-07-17 09:35:33 AM | demo-ubuntu-ms-7b85 | docs.google.com | 00:09:14 | Renewal playbook - Google Docs | |
| 2026-07-17 09:35:18 AM | demo-ubuntu-ms-7b85 | ms-teams.exe | 00:12:44 | Weekly pipeline review | Microsoft Teams | |
| 2026-07-17 09:35:11 AM | demo-ubuntu-ms-7b85 | slack.exe | 00:03:31 | Slack | #general | |
| 2026-07-17 09:34:13 AM | demo-ubuntu-ms-7b85 | explorer.exe | 00:00:02 | Program Manager | |
| 2026-07-17 09:33:33 AM | demo-ubuntu-ms-7b85 | www.pinterest.com | 00:00:01 | Tasty Garlic Shrimp Gratin: Simple and Full of Flavor - Goo… | |
| 2026-07-17 09:33:03 AM | demo-ubuntu-ms-7b85 | windowsterminal.exe | 00:23:02 | Administrator: Windows PowerShell | |
| 2026-07-17 09:32:39 AM | demo-ubuntu-ms-7b85 | chat.google.com | 00:00:01 | Chat | |
| 2026-07-17 09:24:10 AM | demo-ubuntu-ms-7b85 | windowsterminal.exe | 00:23:02 | Administrator: Windows PowerShell | |
| 2026-07-17 09:23:36 AM | demo-ubuntu-ms-7b85 | docs.google.com | 00:09:14 | Renewal playbook - Google Docs | |
| 2026-07-17 09:22:55 AM | demo-ubuntu-ms-7b85 | ms-teams.exe | 00:12:44 | Weekly pipeline review | Microsoft Teams | |
| 2026-07-17 09:16:54 AM | demo-ubuntu-ms-7b85 | windowsterminal.exe | 00:23:02 | Administrator: Windows PowerShell | |
| 2026-07-17 09:16:28 AM | demo-ubuntu-ms-7b85 | ms-teams.exe | 00:12:44 | Weekly pipeline review | Microsoft Teams | |
| 2026-07-17 09:15:54 AM | demo-ubuntu-ms-7b85 | docs.google.com | 00:09:14 | Renewal playbook - Google Docs |
Session Log
| Timestamp | Time | Computer | Source computer | Source IP | |
|---|---|---|---|---|---|
| 2026-07-17 01:20:00 AM | 07:23:21 | demo-ubuntu-ms-7b85 | LAPTOP-GVP0T1A7 | Unavailable in demo | |
| 2026-07-17 02:21:01 AM | 00:02:10 | demo-ubuntu-ms-7b85 | local | Unavailable in demo | |
| 2026-07-17 03:22:02 AM | 00:00:33 | demo-ubuntu-ms-7b85 | LAPTOP-GVP0T1A7 | Unavailable in demo | |
| 2026-07-17 04:23:03 AM | 00:32:54 | demo-ubuntu-ms-7b85 | DESKTOP-1ERSDOM | Unavailable in demo | |
| 2026-07-17 05:24:04 AM | 08:04:11 | demo-ubuntu-ms-7b85 | LAPTOP-GVP0T1A7 | Unavailable in demo |
Time Worked
| Task | Total work time: Work time | Idle time: Work time | Activity: Input activity | Wage: Work time |
|---|---|---|---|---|
| Project Tasks | 44h 35m | 00:25:28 | 26.39% | $2,322.58 |
Alerts
| Timestamp | Computer | Policy | Rule | Action | Description | |
|---|---|---|---|---|---|---|
| 2026-07-17 11:10:50 AM | demo-ubuntu-ms-7b85 | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Warn | Deleted path c:\users\dlee\downloads\joint venture feedback survey.oxps on drive C:. | |
| 2026-07-17 11:04:54 AM | demo-ubuntu-ms-7b85 | TA0007 Discovery | T1016 System Network Configuration Discovery | Warn | Used the application tracert.exe. | |
| 2026-07-17 11:04:25 AM | demo-ubuntu-ms-7b85 | TA0007 Discovery | T1016.001 System Network Configuration Discovery: Internet Connection D… | Warn | Used the application ping.exe. | |
| 2026-07-17 10:55:01 AM | demo-ubuntu-ms-7b85 | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Warn | Deleted path c:\users\dlee\wps cloud files\.3866167729391\tmp.ohxdun on drive C:. | |
| 2026-07-17 10:54:51 AM | demo-ubuntu-ms-7b85 | TA0007 Discovery | T1049 System Network Connections Discovery | Warn | Used the application netstat.exe. | |
| 2026-07-17 10:47:17 AM | demo-ubuntu-ms-7b85 | TA0002 Execution | T1053.002 Scheduled Task/Job: At (Windows) | None | Used the application netstat.exe. | |
| 2026-07-17 10:47:00 AM | demo-ubuntu-ms-7b85 | TA0007 Discovery | T1082 System Information Discovery | Warn | Used the application systeminfo.exe. | |
| 2026-07-17 10:41:07 AM | demo-ubuntu-ms-7b85 | TA0007 Discovery | T1124 System Time Discovery | Warn | Used the application systeminfo.exe. | |
| 2026-07-17 10:40:34 AM | demo-ubuntu-ms-7b85 | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Warn | Deleted path c:\users\dlee\documents\data privacy awareness survey.oxps on drive C:. |
Project Tasks23%
Project Tasks33%
Project Tasks16%
Project Tasks34%
Project Tasks27%
Project Tasks14%
Project Tasks37%
Project Tasks30%
Project Tasks34%
Project Tasks10%
Project Tasks10%
Project Tasks27%
Project Tasks17%
Project Tasks0%
Project Tasks24%
Project Tasks29%
Project Tasks24%
Project Tasks15%
Emails
| Timestamp | Computer | Source | Destination | Attachment | |
|---|---|---|---|---|---|
| 2026-07-17 10:52:52 AM | demo-ubuntu-ms-7b85 | [email protected] | [email protected] | ||
| 2026-07-17 10:51:54 AM | demo-ubuntu-ms-7b85 | [email protected] | [email protected] | ||
| 2026-07-17 10:51:54 AM | demo-ubuntu-ms-7b85 | [email protected] | [email protected] | ||
| 2026-07-17 10:51:23 AM | demo-ubuntu-ms-7b85 | [email protected] | [email protected], [email protected] | Q4-Forecast.ods | |
| 2026-07-17 10:47:44 AM | demo-ubuntu-ms-7b85 | [email protected] | [email protected] |
File Transfers
| Timestamp | Operation | File | Destination | |
|---|---|---|---|---|
| 2026-07-17 08:40 AM | Copy | Q4-Forecast.ods | E:\ (removable) | |
| 2026-07-17 07:41 AM | Write | notes.txt | C:\Users\Public | |
| 2026-07-17 06:42 AM | Upload | deck-v2.pdf | drive.google.com |
Printing
| Timestamp | Document | Printer | Pages | |
|---|---|---|---|---|
| 2026-07-16 03:10 PM | contract_v3.pdf | HP-Floor2 | 12 | |
| 2026-07-17 03:11 PM | boarding-pass.pdf | HP-Floor2 | 1 |
Keystrokes
| Timestamp | Computer | App / Domain | Keystroke | |
|---|---|---|---|---|
| 2026-07-17 08:30:39 AM | demo-ubuntu-ms-7b85 | x.com | <CapsLock>T<CapsLock>here<Space>are<Space>moments<Space>when<Space>everything<Space>feels<Space>uncertain.<Space><CapsLock>T<CapsLock>rust<Space>the<Space>process<Space>a<Space>little | |
| 2026-07-17 08:21:39 AM | demo-ubuntu-ms-7b85 | mail.google.com | <CapsLock>T<CapsLock>hank<Space><CapsLock>Y<CapsLock>ou<Space>for<Space><CapsLock>Y<CapsLock>our<Space><CapsLock>S<CapsLock>u;pp<Backspace><Backspace><Backspace>pport<Tab><Enter> | |
| 2026-07-17 08:12:39 AM | demo-ubuntu-ms-7b85 | mail.google.com | ation<Space>and<Space>professionalism<Space>are<Space>greatly<Space>appre<Tab>.<Enter> | |
| 2026-07-17 08:3:39 AM | demo-ubuntu-ms-7b85 | windowsterminal.exe | Get-ChildItem<Space>-Recurse<Space>C:\Finance\Q4<Enter> |
Online Meetings
| Start | App | Title | Duration | Camera | |
|---|---|---|---|---|---|
| 2026-07-17 09:00 AM | ms-teams.exe | Weekly pipeline review | 42m | On | |
| 2026-07-17 010:00 AM | zoom.exe | Customer onboarding - ACME | 31m | On | |
| 2026-07-17 011:00 AM | ms-teams.exe | 1:1 | 18m | Off |
Network Monitoring
| Timestamp | Process | Remote host | Bytes | |
|---|---|---|---|---|
| 2026-07-17 09:30 AM | chrome.exe | salesforce.com:443 | 4.2 MB | |
| 2026-07-17 08:31 AM | windowsterminal.exe | 10.0.4.21:22 | 812 KB | |
| 2026-07-17 07:32 AM | ms-teams.exe | teams.microsoft.com:443 | 48.1 MB |