Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- MAC-HR-01
- Department
- People & HR
- Role
- People Ops
- Recorder reference
emp_8825- Agent version
- v2.4.1
- Operating system
- macOS 14
- Window
- 08:50–14:00 · Europe/Madrid
- Analysis state
- analyzed
Active vs idle
Active 3.4 h · 66% Waiting / idle 1.8 h · 34%
Active time is the resolved-action count times a measured mean dwell of 2.31 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
5 apps · 44 redactions · 2 capture pauses · 91.8% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
EMP-2026-79842 Employee record change · 08:56–09:51 · 55m 04s EMP-2026-94433 New-hire welcome sequence · 09:17–09:56 · 39m 19s EMP-2026-95175 Employee record change · 09:43–10:12 · 29m 32s EMP-2026-10047 New-hire welcome sequence · 10:07–10:37 · 29m 46s EMP-2026-47397 Employee record change · 10:33–11:44 · 70m 53s EMP-2026-10541 New-hire welcome sequence · 10:58–11:34 · 35m 05s EMP-2026-94391 Employee record change · 11:24–11:59 · 35m 09s EMP-2026-68091 New-hire welcome sequence · 11:52–12:42 · 50m 31s EMP-2026-83712 Employee record change · 12:18–12:53 · 35m 01s EMP-2026-55974 New-hire welcome sequence · 12:42–13:15 · 33m 18s
Detected activities
AS Assign the manager checklist — 09:00, 28 resolved actions OW Open workbook — 09:31, 59 resolved actions SO Schedule the orientation — 09:33, 48 resolved actions OR Open work item — 09:40, 37 resolved actions AS Assign the manager checklist — 09:49, 68 resolved actions RD Re-type the effective date — 09:54, 27 resolved actions TY Track the reply — 10:13, 23 resolved actions SE Send email — 10:30, 40 resolved actions NH Notify HR to assign a manager — 10:50, 33 resolved actions OR Open work item — 11:01, 41 resolved actions NH Notify HR to assign a manager — 11:12, 28 resolved actions AS Assign the manager checklist — 11:21, 37 resolved actions CA Update the downstream account — 11:26, 24 resolved actions UD Upload the supporting documents — 11:56, 53 resolved actions SO Schedule the orientation — 12:01, 32 resolved actions NH Notify HR to assign a manager — 12:22, 28 resolved actions TY Track the reply — 13:06, 44 resolved actions
Applications
HR portal 104m
Excel 88m
Outlook 37m
Teams 22m
Word 3m
Resolved actions / min (0–32)
National tax id — 09:12 Phone number — 09:13 National tax id — 09:19 Free-text note — 09:21 IBAN — 09:27 IBAN — 09:37 Phone number — 10:08 Card number — 10:22 National tax id — 11:15 IBAN — 11:54 IBAN — 11:56 Phone number — 12:10 Email address — 12:48 Card number — 12:54
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-07-08T08:56:31.088+02:00 | Outlook | Draft | Link/Open | DOM | 0.86 | EMP-2026-79842 | |
| 2026-07-08T09:00:27.982+02:00 | Excel | Workbook · line grid | file_save | Field/Reference | DOM | 0.84 | EMP-2026-79842 |
| 2026-07-08T09:04:23.860+02:00 | Excel | Workbook · line grid | keys | typed into Due date, 17 chars | DOM | 0.78 | EMP-2026-79842 |
| 2026-07-08T09:08:19.593+02:00 | Excel | Pivot view | focus | Link/Open | OCR fallback | 0.61 | EMP-2026-79842 |
| 2026-07-08T09:12:15.685+02:00 | Excel | Workbook · summary | navigate | Tab/Details | accessibility-tree | 0.98 | EMP-2026-79842 |
| 2026-07-08T09:16:11.100+02:00 | Excel | Pivot view | navigate | Field/Reference | accessibility-tree | 1 | EMP-2026-79842 |
| 2026-07-08T09:17:12.201+02:00 | Outlook | Inbox | paste | Toolbar/Save | accessibility-tree | 0.9 | EMP-2026-94433 |
| 2026-07-08T09:20:07.987+02:00 | Excel | Workbook · summary | scroll | Button/Post | accessibility-tree | 0.93 | EMP-2026-79842 |
| 2026-07-08T09:24:03.764+02:00 | Excel | Workbook · summary | scroll | Field/Reference | accessibility-tree | 0.92 | EMP-2026-79842 |
| 2026-07-08T09:39:40.489+02:00 | Teams | Direct message | scroll | Tab/Details | DOM | 0.87 | EMP-2026-94433 |
| 2026-07-08T09:42:29.217+02:00 | HR portal | New hire record | click | Link/Open | accessibility-tree | 0.94 | EMP-2026-94433 |
| 2026-07-08T09:45:17.427+02:00 | Outlook | Inbox | focus | Toolbar/Save | accessibility-tree | 0.92 | EMP-2026-94433 |
| 2026-07-08T09:45:20.730+02:00 | HR portal | New hire record | scroll | Toolbar/Save | accessibility-tree | 0.92 | EMP-2026-95175 |
| 2026-07-08T09:47:26.423+02:00 | HR portal | New hire record | click | Tab/Details | accessibility-tree | 0.89 | EMP-2026-95175 |
| 2026-07-08T09:48:06.344+02:00 | HR portal | New hire record | paste | Grid/Row[7]/Value | DOM | 0.75 | EMP-2026-94433 |
| 2026-07-08T09:49:33.196+02:00 | HR portal | New hire record | scroll | Button/Post | accessibility-tree | 0.91 | EMP-2026-95175 |
| 2026-07-08T09:50:54.124+02:00 | Teams | Channel thread | paste | Toolbar/Save | accessibility-tree | 0.97 | EMP-2026-94433 |
| 2026-07-08T09:51:39.769+02:00 | Excel | Pivot view | click | Toolbar/Save | DOM | 0.84 | EMP-2026-95175 |
| 2026-07-08T09:53:43.716+02:00 | HR portal | Document checklist | scroll | Toolbar/Save | accessibility-tree | 0.99 | EMP-2026-94433 |
| 2026-07-08T09:53:46.673+02:00 | Outlook | Inbox | Button/Post | DOM | 0.82 | EMP-2026-95175 | |
| 2026-07-08T09:55:52.440+02:00 | HR portal | Document checklist | scroll | Tab/Details | DOM | 0.86 | EMP-2026-95175 |
| 2026-07-08T09:57:59.358+02:00 | Outlook | Inbox | focus | Grid/Row[24]/Value | DOM | 0.86 | EMP-2026-95175 |
| 2026-07-08T10:07:29.758+02:00 | Teams | Direct message | click | Button/Post | OCR fallback | 0.66 | EMP-2026-10047 |
| 2026-07-08T10:24:30.609+02:00 | HR portal | Document checklist | Toolbar/Save | DOM | 0.86 | EMP-2026-10047 | |
| 2026-07-08T10:26:37.573+02:00 | Teams | Direct message | scroll | Grid/Row[7]/Value | DOM | 0.8 | EMP-2026-10047 |
| 2026-07-08T10:28:45.228+02:00 | HR portal | Document checklist | scroll | Toolbar/Save | accessibility-tree | 0.97 | EMP-2026-10047 |
| 2026-07-08T10:30:52.234+02:00 | HR portal | Document checklist | keys | typed into Due date, 22 chars | OCR fallback | 0.65 | EMP-2026-10047 |
| 2026-07-08T10:33:00.903+02:00 | HR portal | New hire record | Toolbar/Save | accessibility-tree | 0.93 | EMP-2026-10047 | |
| 2026-07-08T10:35:07.122+02:00 | HR portal | Document checklist | keys | typed into Vendor name, 25 chars | DOM | 0.86 | EMP-2026-10047 |
| 2026-07-08T10:38:57.601+02:00 | HR portal | Document checklist | file_save | Toolbar/Save | OCR fallback | 0.65 | EMP-2026-47397 |
| 2026-07-08T10:44:01.154+02:00 | Excel | Workbook · summary | paste | Grid/Row[7]/Value | DOM | 0.85 | EMP-2026-47397 |
| 2026-07-08T10:49:04.592+02:00 | HR portal | New hire record | keys | typed into Amount, 47 chars | accessibility-tree | 0.95 | EMP-2026-47397 |
| 2026-07-08T10:54:08.483+02:00 | Excel | Pivot view | navigate | Tab/Details | DOM | 0.85 | EMP-2026-47397 |
| 2026-07-08T10:58:55.465+02:00 | Teams | Channel thread | file_save | Field/Reference | DOM | 0.8 | EMP-2026-10541 |
| 2026-07-08T10:59:12.241+02:00 | HR portal | Document checklist | focus | Link/Open | accessibility-tree | 0.99 | EMP-2026-47397 |
| 2026-07-08T11:01:25.408+02:00 | Teams | Direct message | paste | Tab/Details | accessibility-tree | 0.88 | EMP-2026-10541 |
| 2026-07-08T11:04:16.557+02:00 | Excel | Workbook · line grid | Toolbar/Save | accessibility-tree | 0.89 | EMP-2026-47397 | |
| 2026-07-08T11:09:20.586+02:00 | HR portal | New hire record | paste | Field/Reference | DOM | 0.85 | EMP-2026-47397 |
| 2026-07-08T11:18:58.011+02:00 | Outlook | Inbox | keys | typed into Subject, 25 chars | accessibility-tree | 0.89 | EMP-2026-10541 |
| 2026-07-08T11:21:28.639+02:00 | Outlook | Draft | paste | Button/Post | DOM | 0.87 | EMP-2026-10541 |
| 2026-07-08T11:23:59.773+02:00 | HR portal | New hire record | file_save | Toolbar/Save | accessibility-tree | 0.94 | EMP-2026-10541 |
| 2026-07-08T11:26:29.863+02:00 | Teams | Channel thread | Button/Post | DOM | 0.81 | EMP-2026-10541 | |
| 2026-07-08T11:28:59.454+02:00 | HR portal | Document checklist | focus | Toolbar/Save | accessibility-tree | 0.98 | EMP-2026-10541 |
| 2026-07-08T11:29:11.756+02:00 | HR portal | New hire record | scroll | Tab/Details | OCR fallback | 0.63 | EMP-2026-94391 |
| 2026-07-08T11:31:30.184+02:00 | HR portal | Document checklist | paste | Tab/Details | OCR fallback | 0.6 | EMP-2026-10541 |
| 2026-07-08T11:31:42.121+02:00 | Outlook | Inbox | click | Grid/Row[6]/Value | DOM | 0.72 | EMP-2026-94391 |
| 2026-07-08T11:34:13.459+02:00 | Outlook | Message detail | paste | Button/Post | OCR fallback | 0.51 | EMP-2026-94391 |
| 2026-07-08T11:36:43.672+02:00 | Excel | Pivot view | scroll | Field/Reference | accessibility-tree | 0.97 | EMP-2026-94391 |
| 2026-07-08T11:39:14.749+02:00 | HR portal | New hire record | navigate | Grid/Row[14]/Value | OCR fallback | 0.24 | EMP-2026-94391 |
| 2026-07-08T11:41:45.426+02:00 | HR portal | New hire record | paste | Field/Reference | accessibility-tree | 0.96 | EMP-2026-94391 |
| 2026-07-08T11:44:15.791+02:00 | Excel | Workbook · line grid | Toolbar/Save | DOM | 0.79 | EMP-2026-94391 | |
| 2026-07-08T11:52:28.259+02:00 | Outlook | Message detail | click | Tab/Details | DOM | 0.84 | EMP-2026-68091 |
| 2026-07-08T11:56:05.353+02:00 | Outlook | Inbox | Tab/Details | accessibility-tree | 0.99 | EMP-2026-68091 | |
| 2026-07-08T12:23:37.618+02:00 | Excel | Pivot view | file_save | Tab/Details | accessibility-tree | 0.93 | EMP-2026-83712 |
| 2026-07-08T12:24:57.413+02:00 | Teams | Channel thread | keys | typed into Amount, 48 chars | DOM | 0.71 | EMP-2026-68091 |
| 2026-07-08T12:26:07.002+02:00 | Outlook | Inbox | Field/Reference | accessibility-tree | 0.91 | EMP-2026-83712 | |
| 2026-07-08T12:28:33.882+02:00 | HR portal | New hire record | navigate | Field/Reference | DOM | 0.79 | EMP-2026-68091 |
| 2026-07-08T12:28:37.279+02:00 | HR portal | Document checklist | scroll | Link/Open | accessibility-tree | 0.96 | EMP-2026-83712 |
| 2026-07-08T12:31:07.616+02:00 | Excel | Workbook · summary | Field/Reference | DOM | 0.87 | EMP-2026-83712 | |
| 2026-07-08T12:32:10.923+02:00 | HR portal | New hire record | keys | typed into Subject, 42 chars | accessibility-tree | 0.95 | EMP-2026-68091 |
| 2026-07-08T12:33:37.192+02:00 | Outlook | Draft | paste | Button/Post | accessibility-tree | 0.92 | EMP-2026-83712 |
| 2026-07-08T12:35:46.523+02:00 | Teams | Direct message | focus | Tab/Details | accessibility-tree | 0.91 | EMP-2026-68091 |
| 2026-07-08T12:36:08.701+02:00 | HR portal | Document checklist | click | Grid/Row[22]/Value | accessibility-tree | 0.98 | EMP-2026-83712 |
| 2026-07-08T12:38:38.794+02:00 | HR portal | New hire record | paste | Grid/Row[6]/Value | accessibility-tree | 0.97 | EMP-2026-83712 |
| 2026-07-08T12:39:23.078+02:00 | Outlook | Inbox | scroll | Link/Open | accessibility-tree | 0.9 | EMP-2026-68091 |
| 2026-07-08T12:42:23.273+02:00 | Outlook | Message detail | paste | Tab/Details | DOM | 0.86 | EMP-2026-55974 |
| 2026-07-08T12:44:46.291+02:00 | Outlook | Inbox | file_save | Tab/Details | accessibility-tree | 0.9 | EMP-2026-55974 |
| 2026-07-08T13:03:47.438+02:00 | Teams | Direct message | paste | Field/Reference | DOM | 0.81 | EMP-2026-55974 |
| 2026-07-08T13:06:10.370+02:00 | Teams | Direct message | keys | typed into Vendor name, 34 chars | DOM | 0.81 | EMP-2026-55974 |
| 2026-07-08T13:08:33.827+02:00 | Outlook | Inbox | file_save | Grid/Row[6]/Value | DOM | 0.83 | EMP-2026-55974 |
| 2026-07-08T13:10:56.668+02:00 | HR portal | Document checklist | click | Button/Post | accessibility-tree | 0.97 | EMP-2026-55974 |
| 2026-07-08T13:13:18.149+02:00 | Outlook | Inbox | focus | Tab/Details | accessibility-tree | 0.95 | EMP-2026-55974 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 40| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
employee_ref Correlation key | string | 31 | EMP-2026-79842 | Not masked | EMP-2026-79842 | Employee record change |
start_date | date | 20 | 2026-07-02 | Not masked | EMP-2026-79842 | Employee record change |
department | string | 12 | People & HR | Not masked | EMP-2026-79842 | Employee record change |
contract_type | string | 36 | Fixed term | Not masked | EMP-2026-79842 | Employee record change |
national_id | string | 34 | ••••••••K | Masked at captureNational tax id masked at capture | EMP-2026-79842 | Employee record change |
employee_ref Correlation key | string | 22 | EMP-2026-94433 | Not masked | EMP-2026-94433 | New-hire welcome sequence |
start_date | date | 12 | 2026-06-21 | Not masked | EMP-2026-94433 | New-hire welcome sequence |
department | string | 42 | People & HR | Not masked | EMP-2026-94433 | New-hire welcome sequence |
contract_type | string | 46 | Permanent | Not masked | EMP-2026-94433 | New-hire welcome sequence |
national_id | string | 20 | ••••••••X | Masked at captureNational tax id masked at capture | EMP-2026-94433 | New-hire welcome sequence |
employee_ref Correlation key | string | 21 | EMP-2026-95175 | Not masked | EMP-2026-95175 | Employee record change |
start_date | date | 15 | 2026-06-18 | Not masked | EMP-2026-95175 | Employee record change |
department | string | 6 | People & HR | Not masked | EMP-2026-95175 | Employee record change |
contract_type | string | 44 | Fixed term | Not masked | EMP-2026-95175 | Employee record change |
national_id | string | 20 | ••••••••V | Masked at captureNational tax id masked at capture | EMP-2026-95175 | Employee record change |
employee_ref Correlation key | string | 27 | EMP-2026-10047 | Not masked | EMP-2026-10047 | New-hire welcome sequence |
start_date | date | 19 | 2026-06-30 | Not masked | EMP-2026-10047 | New-hire welcome sequence |
department | string | 45 | People & HR | Not masked | EMP-2026-10047 | New-hire welcome sequence |
contract_type | string | 21 | Fixed term | Not masked | EMP-2026-10047 | New-hire welcome sequence |
national_id | string | 39 | ••••••••J | Masked at captureNational tax id masked at capture | EMP-2026-10047 | New-hire welcome sequence |
employee_ref Correlation key | string | 10 | EMP-2026-47397 | Not masked | EMP-2026-47397 | Employee record change |
start_date | date | 47 | 2026-06-22 | Not masked | EMP-2026-47397 | Employee record change |
department | string | 16 | People & HR | Not masked | EMP-2026-47397 | Employee record change |
contract_type | string | 18 | Fixed term | Not masked | EMP-2026-47397 | Employee record change |
national_id | string | 18 | ••••••••M | Masked at captureNational tax id masked at capture | EMP-2026-47397 | Employee record change |
employee_ref Correlation key | string | 10 | EMP-2026-10541 | Not masked | EMP-2026-10541 | New-hire welcome sequence |
start_date | date | 12 | 2026-07-11 | Not masked | EMP-2026-10541 | New-hire welcome sequence |
department | string | 29 | People & HR | Not masked | EMP-2026-10541 | New-hire welcome sequence |
contract_type | string | 7 | Fixed term | Not masked | EMP-2026-10541 | New-hire welcome sequence |
national_id | string | 15 | ••••••••X | Masked at captureNational tax id masked at capture | EMP-2026-10541 | New-hire welcome sequence |
employee_ref Correlation key | string | 31 | EMP-2026-94391 | Not masked | EMP-2026-94391 | Employee record change |
start_date | date | 28 | 2026-06-28 | Not masked | EMP-2026-94391 | Employee record change |
department | string | 11 | People & HR | Not masked | EMP-2026-94391 | Employee record change |
contract_type | string | 30 | Fixed term | Not masked | EMP-2026-94391 | Employee record change |
national_id | string | 22 | ••••••••D | Masked at captureNational tax id masked at capture | EMP-2026-94391 | Employee record change |
employee_ref Correlation key | string | 7 | EMP-2026-68091 | Not masked | EMP-2026-68091 | New-hire welcome sequence |
start_date | date | 8 | 2026-06-21 | Not masked | EMP-2026-68091 | New-hire welcome sequence |
department | string | 42 | People & HR | Not masked | EMP-2026-68091 | New-hire welcome sequence |
contract_type | string | 44 | Permanent | Not masked | EMP-2026-68091 | New-hire welcome sequence |
national_id | string | 21 | ••••••••U | Masked at captureNational tax id masked at capture | EMP-2026-68091 | New-hire welcome sequence |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 9- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 436
- Quarantined below 0.70 confidence
- 8
- Unclassified activity instances
- 5
- Blocklist pauses
- 2
- Redactions applied
- 44
- Contributed to the event log
- 91.8%
- 10:03–10:14 Password manager Application on the capture blocklist · 11m 32s
- 11:53–12:06 Banking Application on the capture blocklist · 13m 47s
No recording contributes 100% of its actions — this one contributed 91.8%.