Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- WIN-BO-02
- Department
- Back Office
- Role
- Back-Office Clerk
- Recorder reference
emp_3390- Agent version
- v2.4.1
- Operating system
- Windows 10
- Window
- 09:26–13:00 · Europe/Madrid
- Analysis state
- analyzed
Active vs idle
Active 2.2 h · 62% Waiting / idle 81m 17s · 38%
Active time is the resolved-action count times a measured mean dwell of 2.14 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
3 apps · 29 redactions · 1 capture pauses · 91.7% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
INV-2026-33896 Invoice re-keying (Excel → ERP) · 09:27–10:06 · 39m 12s THR-2026-56121 Email → tracker copy · 09:57–10:36 · 39m 17s PO-2026-75778 PO ↔ invoice 3-way match · 10:16–10:48 · 32m 12s INV-2026-57511 Invoice re-keying (Excel → ERP) · 10:44–11:10 · 26m 27s THR-2026-61604 Email → tracker copy · 11:07–11:43 · 36m 22s PO-2026-63249 PO ↔ invoice 3-way match · 11:37–12:16 · 39m 43s INV-2026-54495 Invoice re-keying (Excel → ERP) · 11:58–12:54 · 55m 23s
Detected activities
CD Check for a duplicate invoice — 09:34, 65 resolved actions KE Key the entry into the ERP — 09:45, 32 resolved actions AP Approve for payment — 10:16, 61 resolved actions MC Map the rows to tracker columns — 10:24, 57 resolved actions CV Copy values between windows — 10:30, 33 resolved actions RQ Request the missing purchase order — 10:42, 61 resolved actions SW Switch application — 10:44, 40 resolved actions PJ Post the journal entry — 10:52, 44 resolved actions SW Switch application — 11:13, 47 resolved actions OE Open the weekly numbers email — 11:37, 30 resolved actions OB Open the invoice batch — 11:53, 30 resolved actions VT Validate totals — 12:25, 42 resolved actions
Applications
ERP client 122m
Excel 30m
Outlook 15m
Resolved actions / min (0–32)
Free-text note — 09:32 Email address — 09:38 Phone number — 09:58 Free-text note — 10:00 Phone number — 10:49 Phone number — 11:02 Phone number — 11:18 Phone number — 11:24 National tax id — 11:36 Card number — 11:39 National tax id — 11:59 Free-text note — 12:11 IBAN — 12:19 National tax id — 12:55
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-07-09T09:27:40.785+02:00 | ERP client | Document search | focus | Tab/Details | accessibility-tree | 0.97 | INV-2026-33896 |
| 2026-07-09T09:30:28.787+02:00 | ERP client | Cost centre lookup | focus | Field/Reference | DOM | 0.84 | INV-2026-33896 |
| 2026-07-09T09:33:16.718+02:00 | Outlook | Message detail | click | Field/Reference | accessibility-tree | 0.88 | INV-2026-33896 |
| 2026-07-09T09:36:04.029+02:00 | Excel | Workbook · summary | Tab/Details | DOM | 0.78 | INV-2026-33896 | |
| 2026-07-09T09:38:52.043+02:00 | Excel | Workbook · summary | file_save | Toolbar/Save | accessibility-tree | 0.99 | INV-2026-33896 |
| 2026-07-09T09:41:40.019+02:00 | Excel | Workbook · line grid | paste | Tab/Details | OCR fallback | 0.51 | INV-2026-33896 |
| 2026-07-09T09:44:28.618+02:00 | ERP client | Vendor invoice — posting | keys | typed into Vendor name, 6 chars | accessibility-tree | 0.95 | INV-2026-33896 |
| 2026-07-09T09:47:16.211+02:00 | Excel | Pivot view | Field/Reference | accessibility-tree | 0.95 | INV-2026-33896 | |
| 2026-07-09T09:50:04.756+02:00 | ERP client | Cost centre lookup | scroll | Field/Reference | accessibility-tree | 0.98 | INV-2026-33896 |
| 2026-07-09T09:52:52.770+02:00 | ERP client | Document search | file_save | Button/Post | OCR fallback | 0.07 | INV-2026-33896 |
| 2026-07-09T09:55:40.298+02:00 | ERP client | Vendor invoice — posting | navigate | Grid/Row[19]/Value | DOM | 0.85 | INV-2026-33896 |
| 2026-07-09T09:57:14.343+02:00 | Excel | Workbook · line grid | file_save | Field/Reference | DOM | 0.87 | THR-2026-56121 |
| 2026-07-09T10:00:02.415+02:00 | Outlook | Message detail | navigate | Button/Post | accessibility-tree | 0.89 | THR-2026-56121 |
| 2026-07-09T10:02:51.186+02:00 | Outlook | Message detail | navigate | Field/Reference | DOM | 0.84 | THR-2026-56121 |
| 2026-07-09T10:05:39.159+02:00 | Excel | Workbook · line grid | file_save | Tab/Details | accessibility-tree | 0.93 | THR-2026-56121 |
| 2026-07-09T10:08:27.926+02:00 | Excel | Workbook · line grid | keys | typed into Vendor name, 20 chars | accessibility-tree | 0.93 | THR-2026-56121 |
| 2026-07-09T10:11:16.204+02:00 | Excel | Pivot view | click | Field/Reference | accessibility-tree | 0.92 | THR-2026-56121 |
| 2026-07-09T10:14:04.515+02:00 | Outlook | Inbox | paste | Grid/Row[16]/Value | accessibility-tree | 0.89 | THR-2026-56121 |
| 2026-07-09T10:16:22.131+02:00 | ERP client | Document search | file_save | Button/Post | DOM | 0.87 | PO-2026-75778 |
| 2026-07-09T10:18:40.790+02:00 | Excel | Workbook · summary | keys | typed into Vendor name, 3 chars | accessibility-tree | 0.95 | PO-2026-75778 |
| 2026-07-09T10:20:58.986+02:00 | SAP (web) | Three-way match | keys | typed into Due date, 35 chars | accessibility-tree | 0.91 | PO-2026-75778 |
| 2026-07-09T10:28:06.887+02:00 | Outlook | Inbox | keys | typed into Subject, 46 chars | accessibility-tree | 0.96 | THR-2026-56121 |
| 2026-07-09T10:30:54.114+02:00 | Outlook | Inbox | keys | typed into Due date, 23 chars | accessibility-tree | 0.91 | THR-2026-56121 |
| 2026-07-09T10:32:28.621+02:00 | Excel | Pivot view | file_save | Tab/Details | OCR fallback | 0.63 | PO-2026-75778 |
| 2026-07-09T10:33:43.315+02:00 | Excel | Workbook · summary | focus | Field/Reference | accessibility-tree | 0.95 | THR-2026-56121 |
| 2026-07-09T10:34:46.380+02:00 | SAP (web) | Purchase order | scroll | Grid/Row[8]/Value | accessibility-tree | 0.96 | PO-2026-75778 |
| 2026-07-09T10:37:04.884+02:00 | Excel | Pivot view | click | Grid/Row[22]/Value | DOM | 0.83 | PO-2026-75778 |
| 2026-07-09T10:39:22.696+02:00 | Excel | Workbook · summary | keys | typed into Reference, 41 chars | accessibility-tree | 0.91 | PO-2026-75778 |
| 2026-07-09T10:41:40.532+02:00 | ERP client | Vendor invoice — posting | file_save | Button/Post | accessibility-tree | 0.94 | PO-2026-75778 |
| 2026-07-09T10:43:58.086+02:00 | Excel | Pivot view | Button/Post | accessibility-tree | 0.98 | PO-2026-75778 | |
| 2026-07-09T10:46:16.136+02:00 | ERP client | Document search | click | Field/Reference | accessibility-tree | 0.98 | PO-2026-75778 |
| 2026-07-09T10:49:40.420+02:00 | Excel | Pivot view | click | Field/Reference | accessibility-tree | 1 | INV-2026-57511 |
| 2026-07-09T10:51:33.100+02:00 | ERP client | Cost centre lookup | click | Toolbar/Save | accessibility-tree | 0.94 | INV-2026-57511 |
| 2026-07-09T10:53:27.685+02:00 | Outlook | Message detail | click | Grid/Row[10]/Value | accessibility-tree | 0.95 | INV-2026-57511 |
| 2026-07-09T10:55:20.297+02:00 | ERP client | Document search | navigate | Toolbar/Save | DOM | 0.83 | INV-2026-57511 |
| 2026-07-09T10:57:14.219+02:00 | Outlook | Message detail | navigate | Toolbar/Save | accessibility-tree | 0.9 | INV-2026-57511 |
| 2026-07-09T10:59:07.848+02:00 | ERP client | Cost centre lookup | scroll | Link/Open | DOM | 0.85 | INV-2026-57511 |
| 2026-07-09T11:01:00.097+02:00 | Outlook | Inbox | file_save | Link/Open | DOM | 0.79 | INV-2026-57511 |
| 2026-07-09T11:02:54.316+02:00 | Outlook | Message detail | file_save | Field/Reference | DOM | 0.83 | INV-2026-57511 |
| 2026-07-09T11:04:47.948+02:00 | Excel | Pivot view | scroll | Tab/Details | accessibility-tree | 0.94 | INV-2026-57511 |
| 2026-07-09T11:06:40.632+02:00 | Outlook | Message detail | keys | typed into Subject, 30 chars | accessibility-tree | 1 | INV-2026-57511 |
| 2026-07-09T11:07:08.808+02:00 | Excel | Workbook · summary | scroll | Toolbar/Save | accessibility-tree | 0.93 | THR-2026-61604 |
| 2026-07-09T11:08:34.334+02:00 | Outlook | Message detail | focus | Link/Open | accessibility-tree | 0.89 | INV-2026-57511 |
| 2026-07-09T11:09:44.695+02:00 | Outlook | Message detail | keys | typed into Subject, 35 chars | accessibility-tree | 0.92 | THR-2026-61604 |
| 2026-07-09T11:12:20.559+02:00 | Excel | Pivot view | Link/Open | accessibility-tree | 0.99 | THR-2026-61604 | |
| 2026-07-09T11:14:56.325+02:00 | Outlook | Message detail | focus | Grid/Row[17]/Value | DOM | 0.84 | THR-2026-61604 |
| 2026-07-09T11:17:31.818+02:00 | Excel | Workbook · summary | click | Tab/Details | DOM | 0.87 | THR-2026-61604 |
| 2026-07-09T11:20:07.845+02:00 | Excel | Workbook · line grid | navigate | Button/Post | OCR fallback | 0.3 | THR-2026-61604 |
| 2026-07-09T11:22:43.781+02:00 | Outlook | Inbox | keys | typed into Cost centre, 43 chars | DOM | 0.81 | THR-2026-61604 |
| 2026-07-09T11:25:19.434+02:00 | Excel | Workbook · line grid | focus | Toolbar/Save | accessibility-tree | 0.88 | THR-2026-61604 |
| 2026-07-09T11:27:55.302+02:00 | Excel | Workbook · summary | click | Tab/Details | OCR fallback | 0.54 | THR-2026-61604 |
| 2026-07-09T11:30:31.579+02:00 | Excel | Pivot view | paste | Field/Reference | accessibility-tree | 0.88 | THR-2026-61604 |
| 2026-07-09T11:37:04.407+02:00 | Excel | Workbook · line grid | click | Toolbar/Save | accessibility-tree | 0.88 | PO-2026-63249 |
| 2026-07-09T11:39:54.815+02:00 | SAP (web) | Three-way match | keys | typed into Vendor name, 48 chars | accessibility-tree | 0.97 | PO-2026-63249 |
| 2026-07-09T11:42:44.079+02:00 | Excel | Workbook · line grid | scroll | Grid/Row[14]/Value | accessibility-tree | 0.91 | PO-2026-63249 |
| 2026-07-09T11:45:35.364+02:00 | SAP (web) | Three-way match | Link/Open | accessibility-tree | 0.89 | PO-2026-63249 | |
| 2026-07-09T11:48:25.465+02:00 | ERP client | Cost centre lookup | scroll | Grid/Row[13]/Value | accessibility-tree | 0.96 | PO-2026-63249 |
| 2026-07-09T11:51:15.198+02:00 | SAP (web) | Purchase order | Toolbar/Save | DOM | 0.8 | PO-2026-63249 | |
| 2026-07-09T11:58:42.075+02:00 | Excel | Pivot view | scroll | Toolbar/Save | accessibility-tree | 0.97 | INV-2026-54495 |
| 2026-07-09T12:02:39.611+02:00 | ERP client | Cost centre lookup | navigate | Field/Reference | accessibility-tree | 0.88 | INV-2026-54495 |
| 2026-07-09T12:05:26.904+02:00 | ERP client | Document search | navigate | Link/Open | OCR fallback | 0.12 | PO-2026-63249 |
| 2026-07-09T12:08:16.519+02:00 | ERP client | Cost centre lookup | scroll | Tab/Details | accessibility-tree | 0.98 | PO-2026-63249 |
| 2026-07-09T12:11:07.996+02:00 | SAP (web) | Three-way match | Field/Reference | accessibility-tree | 0.9 | PO-2026-63249 | |
| 2026-07-09T12:13:57.404+02:00 | ERP client | Vendor invoice — posting | focus | Field/Reference | accessibility-tree | 0.9 | PO-2026-63249 |
| 2026-07-09T12:22:26.810+02:00 | Excel | Pivot view | scroll | Link/Open | DOM | 0.84 | INV-2026-54495 |
| 2026-07-09T12:26:24.448+02:00 | ERP client | Document search | click | Tab/Details | accessibility-tree | 0.93 | INV-2026-54495 |
| 2026-07-09T12:30:21.013+02:00 | ERP client | Vendor invoice — posting | focus | Tab/Details | accessibility-tree | 0.89 | INV-2026-54495 |
| 2026-07-09T12:34:18.284+02:00 | Outlook | Inbox | file_save | Toolbar/Save | accessibility-tree | 0.95 | INV-2026-54495 |
| 2026-07-09T12:38:16.965+02:00 | Excel | Workbook · line grid | focus | Link/Open | accessibility-tree | 0.93 | INV-2026-54495 |
| 2026-07-09T12:42:13.898+02:00 | Excel | Pivot view | paste | Button/Post | accessibility-tree | 0.93 | INV-2026-54495 |
| 2026-07-09T12:46:10.375+02:00 | Excel | Workbook · line grid | paste | Grid/Row[4]/Value | accessibility-tree | 0.94 | INV-2026-54495 |
| 2026-07-09T12:50:08.589+02:00 | Outlook | Draft | focus | Tab/Details | DOM | 0.77 | INV-2026-54495 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 40| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
invoice_no Correlation key | string | 40 | INV-2026-33896 | Not masked | INV-2026-33896 | Invoice re-keying (Excel → ERP) |
supplier | string | 34 | Havensmark Trading NV | Not masked | INV-2026-33896 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 16 | €30,756.25 | Not masked | INV-2026-33896 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 44 | CC-1040 | Not masked | INV-2026-33896 | Invoice re-keying (Excel → ERP) |
vat_code | string | 12 | S21 | Not masked | INV-2026-33896 | Invoice re-keying (Excel → ERP) |
iban | string | 24 | ES•• •••• •••• •••• 5451 | Masked at captureIBAN masked at capture | INV-2026-33896 | Invoice re-keying (Excel → ERP) |
thread_id Correlation key | string | 46 | THR-2026-56121 | Not masked | THR-2026-56121 | Email → tracker copy |
queue | string | 23 | Billing | Not masked | THR-2026-56121 | Email → tracker copy |
priority | string | 23 | P2 | Not masked | THR-2026-56121 | Email → tracker copy |
requester_ref | string | 42 | cust_8678 | Not masked | THR-2026-56121 | Email → tracker copy |
contact_email | string | 34 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | THR-2026-56121 | Email → tracker copy |
po_number Correlation key | string | 24 | PO-2026-75778 | Not masked | PO-2026-75778 | PO ↔ invoice 3-way match |
supplier | string | 43 | Orbita Serveis SCP | Not masked | PO-2026-75778 | PO ↔ invoice 3-way match |
amount_eur | money | 37 | €45,248.49 | Not masked | PO-2026-75778 | PO ↔ invoice 3-way match |
cost_centre | string | 34 | CC-1702 | Not masked | PO-2026-75778 | PO ↔ invoice 3-way match |
vat_code | string | 19 | S9 | Not masked | PO-2026-75778 | PO ↔ invoice 3-way match |
iban | string | 7 | ES•• •••• •••• •••• 3058 | Masked at captureIBAN masked at capture | PO-2026-75778 | PO ↔ invoice 3-way match |
invoice_no Correlation key | string | 19 | INV-2026-57511 | Not masked | INV-2026-57511 | Invoice re-keying (Excel → ERP) |
supplier | string | 33 | Brightline Media Srl | Not masked | INV-2026-57511 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 23 | €15,828.71 | Not masked | INV-2026-57511 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 11 | CC-2137 | Not masked | INV-2026-57511 | Invoice re-keying (Excel → ERP) |
vat_code | string | 11 | S8 | Not masked | INV-2026-57511 | Invoice re-keying (Excel → ERP) |
iban | string | 35 | ES•• •••• •••• •••• 1845 | Masked at captureIBAN masked at capture | INV-2026-57511 | Invoice re-keying (Excel → ERP) |
thread_id Correlation key | string | 30 | THR-2026-61604 | Not masked | THR-2026-61604 | Email → tracker copy |
queue | string | 9 | Tier 2 | Not masked | THR-2026-61604 | Email → tracker copy |
priority | string | 28 | P2 | Not masked | THR-2026-61604 | Email → tracker copy |
requester_ref | string | 47 | cust_4480 | Not masked | THR-2026-61604 | Email → tracker copy |
contact_email | string | 24 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | THR-2026-61604 | Email → tracker copy |
po_number Correlation key | string | 18 | PO-2026-63249 | Not masked | PO-2026-63249 | PO ↔ invoice 3-way match |
supplier | string | 20 | Vallcarca Tecnics SL | Not masked | PO-2026-63249 | PO ↔ invoice 3-way match |
amount_eur | money | 16 | €30,636.12 | Not masked | PO-2026-63249 | PO ↔ invoice 3-way match |
cost_centre | string | 45 | CC-2812 | Not masked | PO-2026-63249 | PO ↔ invoice 3-way match |
vat_code | string | 40 | S12 | Not masked | PO-2026-63249 | PO ↔ invoice 3-way match |
iban | string | 43 | ES•• •••• •••• •••• 9798 | Masked at captureIBAN masked at capture | PO-2026-63249 | PO ↔ invoice 3-way match |
invoice_no Correlation key | string | 46 | INV-2026-54495 | Not masked | INV-2026-54495 | Invoice re-keying (Excel → ERP) |
supplier | string | 28 | Nordvant Components BV | Not masked | INV-2026-54495 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 9 | €24,394.25 | Not masked | INV-2026-54495 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 20 | CC-3123 | Not masked | INV-2026-54495 | Invoice re-keying (Excel → ERP) |
vat_code | string | 45 | S2 | Not masked | INV-2026-54495 | Invoice re-keying (Excel → ERP) |
iban | string | 30 | ES•• •••• •••• •••• 1973 | Masked at captureIBAN masked at capture | INV-2026-54495 | Invoice re-keying (Excel → ERP) |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 9- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 309
- Quarantined below 0.70 confidence
- 6
- Unclassified activity instances
- 3
- Blocklist pauses
- 1
- Redactions applied
- 29
- Contributed to the event log
- 91.7%
- 10:18–10:27 Password manager Application on the capture blocklist · 8m 42s
No recording contributes 100% of its actions — this one contributed 91.7%.