Activity
Maria Bennett
Ethan Stafford
Michael Redmond
Ian Fransson
Denis Lee (Ubuntu)
Thomas Cook
Fang Shen
Tim Farrow (MAC)
Patsy Smith
Kate Sparrow
0%10%20%30%
Web Usage
mail.google.com
x.com
chat.google.com
www.facebook.com
outlook.live.com
chatgpt.com
ntp.msn.com
www.linkedin.com
www.reddit.com
docs.google.com
0s30h60h90h120h
App Usage
ms-teams.exe
slack.exe
windowsterminal.exe
zoom.exe
soffice.bin
explorer.exe
chrome.exe
canva.exe
thunderbird.exe
winrar.exe
0s30h60h90h120h
Behavior Rule Violations
T1070.004 Indicator Remov…
T1016.001 System Network …
TBG003 Copying Multiple F…
T1016 System Network Conn…
Detect OpenClaw Agent Act…
T1083 File and Directory …
T1057 Process Discovery
Block Credit Card Sharing
Detect AI-Native Browser …
Pasting text that contain…
05001000
Live Montage
Live Users
| Employee | Location | Current activity | Work time | Activity Rate | Activity Chart | |
|---|---|---|---|---|---|---|
| James OC Demo | United States / Washington | Windows Explorer | 13h 13m | 0% | ||
| James Gabbert | Germany / Frankfurt | www.trading.com | 4h 15m | 10% | ||
| Simon Woodly | Germany / Frankfurt | x.com | 4h 14m | 6% | ||
| Kate Sparrow | Germany / Frankfurt | x.com | 4h 14m | 8% | ||
| Lisa Holt | Germany / Frankfurt | outlook.live.com | 4h 16m | 29% | ||
| Tim Farrow | Germany / Frankfurt | mail.google.com | 4h 15m | 29% | ||
| Dustin Miller | Germany / Frankfurt | Microsoft Teams | 4h 15m | 31% | ||
| Kevin Wainright | Germany / Frankfurt | Microsoft Teams | 4h 15m | 37% | ||
| Denis Lee (Ubuntu) | - | reddit.com | 4h 12m | 18% | ||
| Leo Gross | Germany / Frankfurt | decrypt.co | 4h 12m | 10% | ||
| Maria Bennett | Germany / Frankfurt | Google Chrome | 0h 12m | 51% | ||
| Vivian De Paul | Germany / Frankfurt | Zoom Meetings | 4h 15m | 15% | ||
| Leo Stiles | Germany / Frankfurt | drive.google.com | 4h 15m | 16% | ||
| Raphael Dantes | Germany / Frankfurt | chatgpt.com | 4h 15m | 14% |
List of Behavior Rule Violations
| Timestamp | Employee ? | Computer ? | Policy | Rule | Description | |
|---|---|---|---|---|---|---|
| 2026-07-17 09:35:37 AM | Raphael Dantes | win-035khor8tef | TA0007 Discovery | T1082 System Information Discovery | Used the application systeminfo.exe. | |
| 2026-07-17 09:32:18 AM | Raphael Dantes | win-035khor8tef | TA0007 Discovery | T1124 System Time Discovery | Used the application systeminfo.exe. | |
| 2026-07-17 09:31:36 AM | Raphael Dantes | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | |
| 2026-07-17 09:31:17 AM | Raphael Dantes | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | |
| 2026-07-17 09:30:52 AM | Tim Farrow | win-035khor8tef | TA0007 Discovery | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application ping.exe. | |
| 2026-07-17 09:25:46 AM | Mohamed Krogh | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | |
| 2026-07-17 09:25:18 AM | Mohamed Krogh | win-035khor8tef | TA0007 Discovery | T1016 System Network Configuration Discovery | Used the application arp.exe. | |
| 2026-07-17 09:25:02 AM | Mohamed Krogh | win-035khor8tef | TA0007 Discovery | T1083 File and Directory Discovery | Used the application find.exe. | |
| 2026-07-17 09:24:29 AM | Mindy Jameson | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | |
| 2026-07-17 09:18:22 AM | Donald Jurickova | win-035khor8tef | TA0007 Discovery | T1057 Process Discovery | Used the application tasklist.exe. | |
| 2026-07-17 09:18:05 AM | Fang Shen | win-035khor8tef | Data Loss Prevention | Pasting text that contains PII | Pasted content matching credit card pattern in outlook.live.com. | |
| 2026-07-17 09:18:05 AM | Thomas Cook | win-035khor8tef | TA0010 Exfiltration | TBG003 Copying Multiple Files to External Drive | Copied 214 files to external drive E:. | |
| 2026-07-17 09:17:28 AM | Raphael Dantes | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\joint venture feedback survey.oxps on drive C:. | |
| 2026-07-17 09:14:53 AM | Mindy Jameson | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mwatson\documents\health plan enrollment list.ods on drive C:. | |
| 2026-07-17 09:14:27 AM | Raphael Dantes | win-035khor8tef | TA0007 Discovery | T1124 System Time Discovery | Used the application systeminfo.exe. | |
| 2026-07-17 09:14:06 AM | Mohamed Krogh | win-035khor8tef | TA0007 Discovery | T1016 System Network Configuration Discovery | Used the application arp.exe. | |
| 2026-07-17 09:13:48 AM | Thomas Cook | win-035khor8tef | TA0010 Exfiltration | TBG003 Copying Multiple Files to External Drive | Copied 214 files to external drive E:. | |
| 2026-07-17 09:05:33 AM | Tim Farrow | win-035khor8tef | TA0007 Discovery | T1016.001 System Network Configuration Discovery: Internet Connection Discovery | Used the application ping.exe. | |
| 2026-07-17 09:05:05 AM | Donald Jurickova | win-035khor8tef | TA0007 Discovery | T1057 Process Discovery | Used the application tasklist.exe. | |
| 2026-07-17 09:04:23 AM | Raphael Dantes | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\rdantes\documents\data privacy awareness survey.oxps on drive C:. | |
| 2026-07-17 08:59:45 AM | Mohamed Krogh | win-035khor8tef | TA0007 Discovery | T1083 File and Directory Discovery | Used the application find.exe. | |
| 2026-07-17 08:59:41 AM | Raphael Dantes | win-035khor8tef | TA0007 Discovery | T1082 System Information Discovery | Used the application systeminfo.exe. | |
| 2026-07-17 08:58:33 AM | Mohamed Krogh | win-035khor8tef | TA0005 Defense Evasion | T1070.004 Indicator Removal on Host: File Deletion | Deleted path c:\users\mkrogh\documents\healthcare business report.odp on drive C:. | |
| 2026-07-17 08:58:02 AM | Fang Shen | win-035khor8tef | Data Loss Prevention | Pasting text that contains PII | Pasted content matching credit card pattern in outlook.live.com. |