Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- WIN-SUP-01
- Department
- Customer Support
- Role
- Support Lead
- Recorder reference
emp_5164- Agent version
- v2.4.1
- Operating system
- Windows 11
- Window
- 08:12–15:33 · Europe/Madrid
- Analysis state
- analyzed
Active vs idle
Active 5.3 h · 72% Waiting / idle 2.1 h · 28%
Active time is the resolved-action count times a measured mean dwell of 2.41 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
5 apps · 17 redactions · 1 capture pauses · 93.6% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
TCK-2026-19242 Ticket triage & canned replies · 08:13–08:57 · 43m 34s TCK-2026-71207 SLA breach alerts · 08:36–10:38 · 2 h RPT-2026-78258 Scheduled report delivery · 09:03–10:52 · 1.8 h TCK-2026-36283 Ticket triage & canned replies · 09:25–11:22 · 1.9 h TCK-2026-94156 SLA breach alerts · 09:54–11:17 · 82m 41s RPT-2026-62330 Scheduled report delivery · 10:13–10:52 · 38m 45s TCK-2026-87182 Ticket triage & canned replies · 10:40–12:07 · 87m 24s TCK-2026-56793 SLA breach alerts · 11:01–11:32 · 31m 16s RPT-2026-61706 Scheduled report delivery · 11:27–12:47 · 80m 14s TCK-2026-67249 Ticket triage & canned replies · 11:49–13:16 · 86m 39s TCK-2026-12432 SLA breach alerts · 12:19–13:44 · 84m 23s RPT-2026-20237 Scheduled report delivery · 12:43–13:43 · 59m 59s TCK-2026-23689 Ticket triage & canned replies · 13:03–14:11 · 68m 10s TCK-2026-75465 SLA breach alerts · 13:28–14:41 · 72m 12s RPT-2026-75837 Scheduled report delivery · 13:49–14:29 · 40m
Detected activities
LO Look up the order status — 08:44, 63 resolved actions AK Acknowledge the alert — 08:45, 56 resolved actions TR Tag and route — 08:46, 48 resolved actions PC Post a handoff note — 08:58, 49 resolved actions ES Escalate to tier 2 — 09:52, 56 resolved actions FD File the document — 10:00, 25 resolved actions RS Resolve the ticket — 10:01, 42 resolved actions RB Retry the failed build — 10:18, 22 resolved actions SK Scan for SLA risk — 10:23, 43 resolved actions RB Retry the failed build — 10:42, 66 resolved actions DF Download file — 10:46, 41 resolved actions RK Re-check the SLA clock — 11:00, 48 resolved actions OQ Open the ticket queue — 11:10, 54 resolved actions CT Classify intent and priority — 11:24, 38 resolved actions RS Resolve the ticket — 11:29, 29 resolved actions AF Alert Ops about the failure — 12:07, 57 resolved actions PM Paste a canned reply — 12:28, 51 resolved actions RB Retry the failed build — 12:50, 50 resolved actions AO Alert the owner — 13:23, 59 resolved actions EM Edit the canned reply — 13:43, 67 resolved actions OQ Open the ticket queue — 13:56, 65 resolved actions AF Alert Ops about the failure — 13:58, 56 resolved actions
Applications
Zendesk 235m
Confluence 40m
Excel 38m
Chrome 33m
Teams 24m
Resolved actions / min (0–33)
Phone number — 08:34 Free-text note — 09:30 IBAN — 10:12 Free-text note — 11:17 Card number — 11:26 Free-text note — 11:28 National tax id — 11:33 Free-text note — 12:02 IBAN — 12:13 Phone number — 13:06 Phone number — 13:36 IBAN — 14:39 Email address — 14:47 Phone number — 14:59
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-07-10T08:13:41.726+02:00 | Zendesk | Macro picker | file_save | Tab/Details | accessibility-tree | 0.98 | TCK-2026-19242 |
| 2026-07-10T08:16:48.889+02:00 | Confluence | Process page | click | Toolbar/Save | DOM | 0.84 | TCK-2026-19242 |
| 2026-07-10T08:19:54.523+02:00 | Zendesk | Queue view | Toolbar/Save | accessibility-tree | 0.91 | TCK-2026-19242 | |
| 2026-07-10T08:23:01.409+02:00 | Chrome | Supplier portal | paste | Grid/Row[2]/Value | DOM | 0.87 | TCK-2026-19242 |
| 2026-07-10T08:26:08.379+02:00 | Zendesk | Macro picker | scroll | Toolbar/Save | accessibility-tree | 0.94 | TCK-2026-19242 |
| 2026-07-10T09:03:19.701+02:00 | ERP client | Cost centre lookup | navigate | Link/Open | OCR fallback | 0.68 | RPT-2026-78258 |
| 2026-07-10T09:20:09.906+02:00 | Chrome | Report export | navigate | Toolbar/Save | accessibility-tree | 0.96 | TCK-2026-71207 |
| 2026-07-10T09:28:52.053+02:00 | Zendesk | Queue view | scroll | Field/Reference | DOM | 0.84 | TCK-2026-71207 |
| 2026-07-10T09:33:52.395+02:00 | Confluence | Runbook | Tab/Details | DOM | 0.86 | TCK-2026-36283 | |
| 2026-07-10T09:37:36.752+02:00 | Zendesk | Queue view | keys | typed into Cost centre, 33 chars | OCR fallback | 0.24 | TCK-2026-71207 |
| 2026-07-10T09:42:14.253+02:00 | Chrome | Supplier portal | keys | typed into Subject, 19 chars | accessibility-tree | 0.97 | TCK-2026-36283 |
| 2026-07-10T09:46:20.682+02:00 | Chrome | Report export | keys | typed into Vendor name, 21 chars | DOM | 0.72 | TCK-2026-71207 |
| 2026-07-10T09:50:35.367+02:00 | Zendesk | Queue view | paste | Button/Post | DOM | 0.87 | TCK-2026-36283 |
| 2026-07-10T09:55:03.634+02:00 | Zendesk | Macro picker | click | Button/Post | DOM | 0.79 | TCK-2026-71207 |
| 2026-07-10T09:58:56.770+02:00 | Confluence | Runbook | focus | Tab/Details | DOM | 0.76 | TCK-2026-36283 |
| 2026-07-10T10:07:17.378+02:00 | Confluence | Process page | Link/Open | DOM | 0.72 | TCK-2026-36283 | |
| 2026-07-10T10:13:48.756+02:00 | Outlook | Message detail | Grid/Row[23]/Value | accessibility-tree | 0.97 | RPT-2026-62330 | |
| 2026-07-10T10:21:05.209+02:00 | ERP client | Vendor invoice — posting | paste | Grid/Row[14]/Value | accessibility-tree | 0.94 | RPT-2026-78258 |
| 2026-07-10T10:28:51.631+02:00 | ERP client | Document search | navigate | Tab/Details | DOM | 0.79 | RPT-2026-78258 |
| 2026-07-10T10:29:52.297+02:00 | Zendesk | Queue view | click | Grid/Row[8]/Value | OCR fallback | 0.59 | TCK-2026-94156 |
| 2026-07-10T10:35:47.586+02:00 | Chrome | Internal wiki | Toolbar/Save | accessibility-tree | 0.92 | TCK-2026-94156 | |
| 2026-07-10T10:36:38.153+02:00 | ERP client | Document search | navigate | Link/Open | accessibility-tree | 0.92 | RPT-2026-78258 |
| 2026-07-10T10:41:29.037+02:00 | CRM (web) | Activity log | navigate | Grid/Row[13]/Value | accessibility-tree | 0.96 | RPT-2026-62330 |
| 2026-07-10T10:41:41.499+02:00 | Zendesk | Queue view | click | Tab/Details | accessibility-tree | 0.91 | TCK-2026-94156 |
| 2026-07-10T10:44:15.790+02:00 | Outlook | Draft | keys | typed into Cost centre, 23 chars | DOM | 0.78 | RPT-2026-62330 |
| 2026-07-10T10:44:24.034+02:00 | ERP client | Cost centre lookup | file_save | Link/Open | DOM | 0.81 | RPT-2026-78258 |
| 2026-07-10T10:46:32.456+02:00 | Confluence | Process page | Button/Post | DOM | 0.82 | TCK-2026-87182 | |
| 2026-07-10T10:47:01.399+02:00 | Outlook | Message detail | keys | typed into Amount, 14 chars | accessibility-tree | 1 | RPT-2026-62330 |
| 2026-07-10T10:47:35.016+02:00 | Teams | Channel thread | file_save | Link/Open | DOM | 0.73 | TCK-2026-94156 |
| 2026-07-10T10:49:47.431+02:00 | Outlook | Message detail | Button/Post | accessibility-tree | 0.94 | RPT-2026-62330 | |
| 2026-07-10T10:52:46.868+02:00 | Confluence | Runbook | click | Link/Open | accessibility-tree | 0.9 | TCK-2026-87182 |
| 2026-07-10T10:59:01.586+02:00 | Confluence | Process page | focus | Field/Reference | accessibility-tree | 0.96 | TCK-2026-87182 |
| 2026-07-10T11:05:15.060+02:00 | Confluence | Runbook | paste | Grid/Row[7]/Value | DOM | 0.79 | TCK-2026-87182 |
| 2026-07-10T11:11:30.343+02:00 | Zendesk | Ticket detail | paste | Tab/Details | accessibility-tree | 0.91 | TCK-2026-87182 |
| 2026-07-10T11:14:26.791+02:00 | Zendesk | Macro picker | scroll | Button/Post | OCR fallback | 0.69 | TCK-2026-56793 |
| 2026-07-10T11:16:40.044+02:00 | Chrome | Supplier portal | focus | Field/Reference | DOM | 0.78 | TCK-2026-56793 |
| 2026-07-10T11:18:54.547+02:00 | Zendesk | Queue view | paste | Toolbar/Save | DOM | 0.77 | TCK-2026-56793 |
| 2026-07-10T11:21:08.912+02:00 | Teams | Channel thread | Field/Reference | DOM | 0.87 | TCK-2026-56793 | |
| 2026-07-10T11:23:22.613+02:00 | Teams | Direct message | scroll | Tab/Details | OCR fallback | 0.61 | TCK-2026-56793 |
| 2026-07-10T11:27:35.457+02:00 | ERP client | Cost centre lookup | keys | typed into Subject, 40 chars | DOM | 0.72 | RPT-2026-61706 |
| 2026-07-10T11:33:19.683+02:00 | ERP client | Cost centre lookup | click | Tab/Details | accessibility-tree | 0.89 | RPT-2026-61706 |
| 2026-07-10T12:01:45.389+02:00 | Confluence | Runbook | paste | Field/Reference | accessibility-tree | 0.93 | TCK-2026-67249 |
| 2026-07-10T12:07:56.791+02:00 | Zendesk | Macro picker | keys | typed into Due date, 36 chars | accessibility-tree | 0.89 | TCK-2026-67249 |
| 2026-07-10T12:14:07.126+02:00 | Zendesk | Queue view | focus | Toolbar/Save | accessibility-tree | 0.98 | TCK-2026-67249 |
| 2026-07-10T12:20:19.528+02:00 | Chrome | Internal wiki | paste | Grid/Row[9]/Value | accessibility-tree | 0.9 | TCK-2026-67249 |
| 2026-07-10T12:30:37.071+02:00 | Outlook | Message detail | scroll | Field/Reference | accessibility-tree | 1 | RPT-2026-61706 |
| 2026-07-10T12:36:21.139+02:00 | Outlook | Message detail | navigate | Toolbar/Save | DOM | 0.81 | RPT-2026-61706 |
| 2026-07-10T12:42:05.505+02:00 | Outlook | Draft | Field/Reference | accessibility-tree | 0.98 | RPT-2026-61706 | |
| 2026-07-10T12:43:11.229+02:00 | CRM (web) | Account record | file_save | Grid/Row[9]/Value | DOM | 0.73 | RPT-2026-20237 |
| 2026-07-10T12:47:28.515+02:00 | CRM (web) | Account record | click | Button/Post | accessibility-tree | 0.91 | RPT-2026-20237 |
| 2026-07-10T12:56:07.610+02:00 | Chrome | Report export | Field/Reference | DOM | 0.82 | TCK-2026-12432 | |
| 2026-07-10T13:02:09.793+02:00 | Chrome | Internal wiki | paste | Field/Reference | DOM | 0.77 | TCK-2026-12432 |
| 2026-07-10T13:08:10.361+02:00 | Teams | Direct message | navigate | Link/Open | accessibility-tree | 0.92 | TCK-2026-12432 |
| 2026-07-10T13:13:20.122+02:00 | Zendesk | Macro picker | scroll | Link/Open | accessibility-tree | 0.93 | TCK-2026-23689 |
| 2026-07-10T13:14:12.252+02:00 | Teams | Channel thread | scroll | Field/Reference | accessibility-tree | 0.93 | TCK-2026-12432 |
| 2026-07-10T13:18:12.145+02:00 | Zendesk | Ticket detail | paste | Tab/Details | accessibility-tree | 0.92 | TCK-2026-23689 |
| 2026-07-10T13:20:13.636+02:00 | Zendesk | Queue view | click | Link/Open | DOM | 0.8 | TCK-2026-12432 |
| 2026-07-10T13:23:05.980+02:00 | Chrome | Supplier portal | click | Toolbar/Save | DOM | 0.75 | TCK-2026-23689 |
| 2026-07-10T13:27:57.630+02:00 | Confluence | Runbook | file_save | Button/Post | accessibility-tree | 0.98 | TCK-2026-23689 |
| 2026-07-10T13:30:19.730+02:00 | Outlook | Draft | navigate | Tab/Details | DOM | 0.75 | RPT-2026-20237 |
| 2026-07-10T13:32:49.864+02:00 | Zendesk | Macro picker | click | Toolbar/Save | DOM | 0.86 | TCK-2026-23689 |
| 2026-07-10T13:34:36.559+02:00 | ERP client | Vendor invoice — posting | scroll | Link/Open | DOM | 0.8 | RPT-2026-20237 |
| 2026-07-10T13:38:53.002+02:00 | ERP client | Vendor invoice — posting | focus | Button/Post | DOM | 0.87 | RPT-2026-20237 |
| 2026-07-10T13:49:45.875+02:00 | Outlook | Message detail | Button/Post | accessibility-tree | 0.98 | RPT-2026-75837 | |
| 2026-07-10T13:52:36.065+02:00 | Outlook | Draft | scroll | Field/Reference | accessibility-tree | 0.91 | RPT-2026-75837 |
| 2026-07-10T14:04:59.161+02:00 | Teams | Channel thread | navigate | Link/Open | accessibility-tree | 0.97 | TCK-2026-75465 |
| 2026-07-10T14:10:08.844+02:00 | Teams | Direct message | file_save | Grid/Row[16]/Value | accessibility-tree | 0.88 | TCK-2026-75465 |
| 2026-07-10T14:15:18.813+02:00 | Teams | Direct message | file_save | Grid/Row[13]/Value | accessibility-tree | 0.88 | TCK-2026-75465 |
| 2026-07-10T14:20:27.486+02:00 | Teams | Direct message | paste | Toolbar/Save | accessibility-tree | 0.91 | TCK-2026-75465 |
| 2026-07-10T14:24:02.973+02:00 | ERP client | Cost centre lookup | file_save | Grid/Row[22]/Value | DOM | 0.84 | RPT-2026-75837 |
| 2026-07-10T14:25:37.467+02:00 | Chrome | Supplier portal | scroll | Toolbar/Save | accessibility-tree | 0.9 | TCK-2026-75465 |
| 2026-07-10T14:26:54.070+02:00 | Outlook | Draft | click | Field/Reference | DOM | 0.82 | RPT-2026-75837 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 42| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
ticket_id Correlation key | string | 16 | TCK-2026-19242 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
queue | string | 35 | Tier 2 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
priority | string | 30 | P1 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
requester_ref | string | 42 | cust_7492 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
contact_email | string | 8 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-19242 | Ticket triage & canned replies |
ticket_id Correlation key | string | 48 | TCK-2026-71207 | Not masked | TCK-2026-71207 | SLA breach alerts |
queue | string | 46 | Tier 2 | Not masked | TCK-2026-71207 | SLA breach alerts |
priority | string | 12 | P2 | Not masked | TCK-2026-71207 | SLA breach alerts |
requester_ref | string | 21 | cust_7692 | Not masked | TCK-2026-71207 | SLA breach alerts |
contact_email | string | 46 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-71207 | SLA breach alerts |
report_ref Correlation key | string | 17 | RPT-2026-78258 | Not masked | RPT-2026-78258 | Scheduled report delivery |
account | string | 23 | Atlas Papeleria SA | Not masked | RPT-2026-78258 | Scheduled report delivery |
amount_eur | money | 33 | €26,195.35 | Not masked | RPT-2026-78258 | Scheduled report delivery |
region | string | 44 | Iberia | Not masked | RPT-2026-78258 | Scheduled report delivery |
owner_role | string | 23 | Sales Ops | Not masked | RPT-2026-78258 | Scheduled report delivery |
contact_phone | string | 14 | +34 ••• ••• 475 | Masked at capturePhone number masked at capture | RPT-2026-78258 | Scheduled report delivery |
ticket_id Correlation key | string | 44 | TCK-2026-36283 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
queue | string | 29 | Tier 2 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
priority | string | 18 | P3 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
requester_ref | string | 36 | cust_1264 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
contact_email | string | 19 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-36283 | Ticket triage & canned replies |
ticket_id Correlation key | string | 45 | TCK-2026-94156 | Not masked | TCK-2026-94156 | SLA breach alerts |
queue | string | 24 | Tier 2 | Not masked | TCK-2026-94156 | SLA breach alerts |
priority | string | 44 | P3 | Not masked | TCK-2026-94156 | SLA breach alerts |
requester_ref | string | 26 | cust_8082 | Not masked | TCK-2026-94156 | SLA breach alerts |
contact_email | string | 43 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-94156 | SLA breach alerts |
report_ref Correlation key | string | 13 | RPT-2026-62330 | Not masked | RPT-2026-62330 | Scheduled report delivery |
account | string | 37 | Brightline Media Srl | Not masked | RPT-2026-62330 | Scheduled report delivery |
amount_eur | money | 18 | €19,568.24 | Not masked | RPT-2026-62330 | Scheduled report delivery |
region | string | 37 | Iberia | Not masked | RPT-2026-62330 | Scheduled report delivery |
owner_role | string | 43 | Sales Ops | Not masked | RPT-2026-62330 | Scheduled report delivery |
contact_phone | string | 18 | +34 ••• ••• 320 | Masked at capturePhone number masked at capture | RPT-2026-62330 | Scheduled report delivery |
ticket_id Correlation key | string | 19 | TCK-2026-87182 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
queue | string | 31 | Tier 2 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
priority | string | 45 | P3 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
requester_ref | string | 21 | cust_3728 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
contact_email | string | 38 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-87182 | Ticket triage & canned replies |
ticket_id Correlation key | string | 29 | TCK-2026-56793 | Not masked | TCK-2026-56793 | SLA breach alerts |
queue | string | 29 | Tier 2 | Not masked | TCK-2026-56793 | SLA breach alerts |
priority | string | 48 | P3 | Not masked | TCK-2026-56793 | SLA breach alerts |
requester_ref | string | 45 | cust_2910 | Not masked | TCK-2026-56793 | SLA breach alerts |
contact_email | string | 22 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-56793 | SLA breach alerts |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 10- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 506
- Quarantined below 0.70 confidence
- 5
- Unclassified activity instances
- 7
- Blocklist pauses
- 1
- Redactions applied
- 17
- Contributed to the event log
- 93.6%
- 09:53–10:06 Password manager Application on the capture blocklist · 12m 43s
No recording contributes 100% of its actions — this one contributed 93.6%.