Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- WIN-FIN-02
- Department
- Finance
- Role
- Financial Controller
- Recorder reference
emp_2038- Agent version
- v2.4.1
- Operating system
- Windows 11
- Window
- 08:34–14:22 · Europe/Madrid
- Analysis state
- analyzed
Active vs idle
Active 4.1 h · 70% Waiting / idle 1.7 h · 30%
Active time is the resolved-action count times a measured mean dwell of 2.44 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
4 apps · 51 redactions · 1 capture pauses · 91% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
INV-2026-05864 Invoice re-keying (Excel → ERP) · 08:35–10:06 · 1.5 h STM-2026-47156 Multi-window reconciliation · 09:06–09:37 · 31m 03s STM-2026-66483 Bank statement auto-match · 09:31–10:31 · 59m 58s PO-2026-98862 PO ↔ invoice 3-way match · 09:55–10:54 · 58m 30s INV-2026-13662 Invoice re-keying (Excel → ERP) · 10:21–11:49 · 87m 10s STM-2026-68221 Multi-window reconciliation · 10:46–12:05 · 78m 48s STM-2026-23936 Bank statement auto-match · 11:16–12:12 · 55m 43s PO-2026-61275 PO ↔ invoice 3-way match · 11:36–12:53 · 77m 07s INV-2026-07465 Invoice re-keying (Excel → ERP) · 12:07–13:17 · 70m 02s STM-2026-46556 Multi-window reconciliation · 12:29–13:43 · 74m 17s STM-2026-15260 Bank statement auto-match · 12:58–13:33 · 35m 36s
Detected activities
CM Chase a mismatch in the ERP — 09:10, 47 resolved actions AW Align two windows side by side — 09:14, 53 resolved actions SL Split the statement line — 10:00, 62 resolved actions RP Read the invoice PDF — 10:01, 47 resolved actions RP Read the invoice PDF — 10:04, 48 resolved actions PL Open the bank portal — 10:19, 40 resolved actions AP Approve for payment — 10:28, 62 resolved actions RQ Request the missing purchase order — 10:35, 42 resolved actions RP Read the invoice PDF — 10:53, 41 resolved actions VT Validate totals — 11:25, 60 resolved actions FX Reconcile the currency difference — 11:43, 27 resolved actions PL Open the bank portal — 11:46, 44 resolved actions AW Align two windows side by side — 11:51, 56 resolved actions SL Split the statement line — 12:01, 27 resolved actions RM Route the mismatch — 12:22, 24 resolved actions SW Switch application — 12:38, 51 resolved actions CD Check for a duplicate invoice — 12:39, 67 resolved actions CM Chase a mismatch in the ERP — 13:02, 35 resolved actions FX Reconcile the currency difference — 13:28, 66 resolved actions
Applications
Excel 147m
ERP client 95m
Chrome 34m
Outlook 23m
Resolved actions / min (0–32)
Free-text note — 08:37 Card number — 08:51 Card number — 08:53 Email address — 09:10 IBAN — 09:26 IBAN — 10:16 Phone number — 10:19 Card number — 10:59 National tax id — 11:20 National tax id — 11:24 Phone number — 12:11 Phone number — 12:35 Card number — 13:36 Free-text note — 14:00
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-06-30T08:35:15.832+02:00 | ERP client | Cost centre lookup | Field/Reference | OCR fallback | 0.54 | INV-2026-05864 | |
| 2026-06-30T08:41:47.283+02:00 | ERP client | Cost centre lookup | paste | Field/Reference | accessibility-tree | 0.95 | INV-2026-05864 |
| 2026-06-30T08:48:19.228+02:00 | Outlook | Message detail | paste | Toolbar/Save | accessibility-tree | 0.93 | INV-2026-05864 |
| 2026-06-30T08:54:51.329+02:00 | ERP client | Document search | click | Link/Open | accessibility-tree | 0.91 | INV-2026-05864 |
| 2026-06-30T09:01:24.136+02:00 | ERP client | Document search | click | Field/Reference | OCR fallback | 0.51 | INV-2026-05864 |
| 2026-06-30T09:07:56.471+02:00 | Outlook | Draft | focus | Tab/Details | OCR fallback | 0.38 | INV-2026-05864 |
| 2026-06-30T09:14:28.023+02:00 | Excel | Workbook · summary | focus | Field/Reference | DOM | 0.86 | INV-2026-05864 |
| 2026-06-30T09:22:12.151+02:00 | SAP (web) | Three-way match | Field/Reference | accessibility-tree | 0.9 | STM-2026-47156 | |
| 2026-06-30T09:24:25.481+02:00 | ERP client | Cost centre lookup | scroll | Grid/Row[3]/Value | accessibility-tree | 0.93 | STM-2026-47156 |
| 2026-06-30T09:26:38.168+02:00 | Excel | Pivot view | Button/Post | accessibility-tree | 0.92 | STM-2026-47156 | |
| 2026-06-30T09:28:51.995+02:00 | SAP (web) | Purchase order | focus | Grid/Row[6]/Value | accessibility-tree | 0.96 | STM-2026-47156 |
| 2026-06-30T09:31:04.440+02:00 | Excel | Pivot view | focus | Toolbar/Save | DOM | 0.82 | STM-2026-47156 |
| 2026-06-30T09:31:43.421+02:00 | ERP client | Document search | paste | Toolbar/Save | DOM | 0.78 | STM-2026-66483 |
| 2026-06-30T09:33:17.516+02:00 | Excel | Pivot view | Toolbar/Save | accessibility-tree | 0.9 | STM-2026-47156 | |
| 2026-06-30T09:35:30.075+02:00 | SAP (web) | Three-way match | Grid/Row[7]/Value | accessibility-tree | 0.94 | STM-2026-47156 | |
| 2026-06-30T09:36:00.719+02:00 | ERP client | Document search | navigate | Toolbar/Save | accessibility-tree | 0.91 | STM-2026-66483 |
| 2026-06-30T09:40:17.734+02:00 | Chrome | Supplier portal | Field/Reference | DOM | 0.84 | STM-2026-66483 | |
| 2026-06-30T09:44:34.166+02:00 | Chrome | Report export | file_save | Toolbar/Save | DOM | 0.83 | STM-2026-66483 |
| 2026-06-30T09:48:51.013+02:00 | Excel | Workbook · summary | keys | typed into Vendor name, 36 chars | accessibility-tree | 0.97 | STM-2026-66483 |
| 2026-06-30T09:53:08.339+02:00 | Chrome | Supplier portal | file_save | Link/Open | DOM | 0.8 | STM-2026-66483 |
| 2026-06-30T10:20:54.808+02:00 | ERP client | Cost centre lookup | paste | Field/Reference | accessibility-tree | 0.9 | PO-2026-98862 |
| 2026-06-30T10:21:58.026+02:00 | Excel | Workbook · line grid | navigate | Toolbar/Save | DOM | 0.81 | INV-2026-13662 |
| 2026-06-30T10:25:05.130+02:00 | Excel | Workbook · line grid | paste | Button/Post | DOM | 0.87 | PO-2026-98862 |
| 2026-06-30T10:28:12.275+02:00 | ERP client | Cost centre lookup | paste | Button/Post | accessibility-tree | 0.89 | INV-2026-13662 |
| 2026-06-30T10:29:16.068+02:00 | Excel | Pivot view | scroll | Toolbar/Save | accessibility-tree | 0.93 | PO-2026-98862 |
| 2026-06-30T10:33:26.502+02:00 | Excel | Workbook · line grid | scroll | Grid/Row[8]/Value | accessibility-tree | 0.94 | PO-2026-98862 |
| 2026-06-30T10:34:25.259+02:00 | Excel | Workbook · line grid | paste | Link/Open | accessibility-tree | 0.89 | INV-2026-13662 |
| 2026-06-30T10:37:37.850+02:00 | Excel | Workbook · line grid | click | Link/Open | DOM | 0.84 | PO-2026-98862 |
| 2026-06-30T10:40:39.202+02:00 | Outlook | Draft | click | Link/Open | OCR fallback | 0.61 | INV-2026-13662 |
| 2026-06-30T10:41:48.202+02:00 | SAP (web) | Purchase order | file_save | Link/Open | DOM | 0.76 | PO-2026-98862 |
| 2026-06-30T10:45:59.129+02:00 | Excel | Pivot view | navigate | Toolbar/Save | DOM | 0.77 | PO-2026-98862 |
| 2026-06-30T10:46:52.195+02:00 | Outlook | Message detail | file_save | Toolbar/Save | accessibility-tree | 0.94 | INV-2026-13662 |
| 2026-06-30T11:14:27.075+02:00 | ERP client | Cost centre lookup | click | Button/Post | DOM | 0.85 | STM-2026-68221 |
| 2026-06-30T11:16:29.473+02:00 | Chrome | Internal wiki | click | Field/Reference | DOM | 0.85 | STM-2026-23936 |
| 2026-06-30T11:20:04.084+02:00 | Excel | Pivot view | navigate | Toolbar/Save | accessibility-tree | 0.98 | STM-2026-68221 |
| 2026-06-30T11:20:28.303+02:00 | Excel | Workbook · summary | click | Grid/Row[19]/Value | DOM | 0.87 | STM-2026-23936 |
| 2026-06-30T11:24:27.562+02:00 | ERP client | Cost centre lookup | keys | typed into Vendor name, 42 chars | OCR fallback | 0.58 | STM-2026-23936 |
| 2026-06-30T11:25:42.356+02:00 | ERP client | Cost centre lookup | paste | Grid/Row[19]/Value | accessibility-tree | 0.91 | STM-2026-68221 |
| 2026-06-30T11:28:25.608+02:00 | Excel | Workbook · summary | keys | typed into Subject, 43 chars | accessibility-tree | 0.88 | STM-2026-23936 |
| 2026-06-30T11:31:20.262+02:00 | ERP client | Vendor invoice — posting | keys | typed into Vendor name, 22 chars | OCR fallback | 0.4 | STM-2026-68221 |
| 2026-06-30T11:36:57.197+02:00 | SAP (web) | Three-way match | click | Field/Reference | accessibility-tree | 0.9 | STM-2026-68221 |
| 2026-06-30T11:42:35.239+02:00 | ERP client | Vendor invoice — posting | scroll | Tab/Details | DOM | 0.83 | STM-2026-68221 |
| 2026-06-30T11:42:54.260+02:00 | Outlook | Draft | click | Tab/Details | DOM | 0.85 | INV-2026-13662 |
| 2026-06-30T11:48:13.858+02:00 | Excel | Pivot view | keys | typed into Reference, 16 chars | DOM | 0.87 | STM-2026-68221 |
| 2026-06-30T11:58:48.201+02:00 | ERP client | Cost centre lookup | Link/Open | accessibility-tree | 0.98 | PO-2026-61275 | |
| 2026-06-30T12:04:14.838+02:00 | Chrome | Internal wiki | click | Field/Reference | DOM | 0.74 | STM-2026-23936 |
| 2026-06-30T12:04:19.566+02:00 | ERP client | Cost centre lookup | paste | Link/Open | DOM | 0.86 | PO-2026-61275 |
| 2026-06-30T12:07:45.031+02:00 | Excel | Pivot view | file_save | Grid/Row[9]/Value | OCR fallback | 0.66 | INV-2026-07465 |
| 2026-06-30T12:08:13.560+02:00 | Chrome | Supplier portal | focus | Grid/Row[22]/Value | accessibility-tree | 0.94 | STM-2026-23936 |
| 2026-06-30T12:09:49.293+02:00 | Excel | Workbook · summary | keys | typed into Vendor name, 47 chars | DOM | 0.72 | PO-2026-61275 |
| 2026-06-30T12:12:45.224+02:00 | Outlook | Inbox | Field/Reference | OCR fallback | 0.55 | INV-2026-07465 | |
| 2026-06-30T12:15:20.842+02:00 | ERP client | Document search | keys | typed into Subject, 30 chars | DOM | 0.85 | PO-2026-61275 |
| 2026-06-30T12:17:45.766+02:00 | Outlook | Message detail | Toolbar/Save | accessibility-tree | 0.94 | INV-2026-07465 | |
| 2026-06-30T12:20:50.907+02:00 | Excel | Workbook · line grid | focus | Link/Open | accessibility-tree | 0.98 | PO-2026-61275 |
| 2026-06-30T12:26:21.469+02:00 | Excel | Workbook · summary | click | Grid/Row[22]/Value | accessibility-tree | 0.93 | PO-2026-61275 |
| 2026-06-30T12:31:51.079+02:00 | Excel | Workbook · summary | file_save | Button/Post | accessibility-tree | 0.96 | PO-2026-61275 |
| 2026-06-30T12:45:31.956+02:00 | Excel | Pivot view | focus | Field/Reference | DOM | 0.86 | STM-2026-46556 |
| 2026-06-30T12:50:49.855+02:00 | SAP (web) | Purchase order | paste | Link/Open | accessibility-tree | 0.97 | STM-2026-46556 |
| 2026-06-30T12:56:08.599+02:00 | SAP (web) | Three-way match | focus | Tab/Details | OCR fallback | 0.53 | STM-2026-46556 |
| 2026-06-30T12:58:06.968+02:00 | Excel | Workbook · line grid | navigate | Button/Post | DOM | 0.79 | STM-2026-15260 |
| 2026-06-30T13:00:39.154+02:00 | Excel | Workbook · summary | scroll | Button/Post | accessibility-tree | 1 | STM-2026-15260 |
| 2026-06-30T13:01:26.490+02:00 | Excel | Pivot view | navigate | Tab/Details | accessibility-tree | 0.98 | STM-2026-46556 |
| 2026-06-30T13:02:47.329+02:00 | ERP client | Vendor invoice — posting | file_save | Toolbar/Save | accessibility-tree | 0.92 | INV-2026-07465 |
| 2026-06-30T13:06:45.560+02:00 | Excel | Workbook · line grid | keys | typed into Amount, 28 chars | accessibility-tree | 0.94 | STM-2026-46556 |
| 2026-06-30T13:07:47.800+02:00 | Outlook | Inbox | click | Field/Reference | OCR fallback | 0.58 | INV-2026-07465 |
| 2026-06-30T13:12:03.022+02:00 | ERP client | Cost centre lookup | Field/Reference | accessibility-tree | 0.88 | STM-2026-46556 | |
| 2026-06-30T13:12:47.918+02:00 | ERP client | Cost centre lookup | Grid/Row[13]/Value | accessibility-tree | 0.93 | INV-2026-07465 | |
| 2026-06-30T13:17:21.259+02:00 | SAP (web) | Purchase order | focus | Tab/Details | accessibility-tree | 0.92 | STM-2026-46556 |
| 2026-06-30T13:23:32.663+02:00 | ERP client | Vendor invoice — posting | scroll | Grid/Row[14]/Value | accessibility-tree | 0.88 | STM-2026-15260 |
| 2026-06-30T13:26:04.778+02:00 | Chrome | Internal wiki | navigate | Toolbar/Save | accessibility-tree | 0.88 | STM-2026-15260 |
| 2026-06-30T13:28:37.242+02:00 | Excel | Pivot view | Button/Post | DOM | 0.83 | STM-2026-15260 | |
| 2026-06-30T13:31:09.440+02:00 | Excel | Workbook · line grid | scroll | Toolbar/Save | accessibility-tree | 0.89 | STM-2026-15260 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 48| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
invoice_no Correlation key | string | 7 | INV-2026-05864 | Not masked | INV-2026-05864 | Invoice re-keying (Excel → ERP) |
supplier | string | 14 | Kestrel Logistics GmbH | Not masked | INV-2026-05864 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 36 | €40,405.58 | Not masked | INV-2026-05864 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 27 | CC-2800 | Not masked | INV-2026-05864 | Invoice re-keying (Excel → ERP) |
vat_code | string | 35 | S18 | Not masked | INV-2026-05864 | Invoice re-keying (Excel → ERP) |
iban | string | 10 | ES•• •••• •••• •••• 9440 | Masked at captureIBAN masked at capture | INV-2026-05864 | Invoice re-keying (Excel → ERP) |
statement_ref Correlation key | string | 27 | STM-2026-47156 | Not masked | STM-2026-47156 | Multi-window reconciliation |
supplier | string | 25 | Kestrel Logistics GmbH | Not masked | STM-2026-47156 | Multi-window reconciliation |
amount_eur | money | 41 | €29,154.22 | Not masked | STM-2026-47156 | Multi-window reconciliation |
cost_centre | string | 24 | CC-4108 | Not masked | STM-2026-47156 | Multi-window reconciliation |
vat_code | string | 47 | S21 | Not masked | STM-2026-47156 | Multi-window reconciliation |
iban | string | 44 | ES•• •••• •••• •••• 9111 | Masked at captureIBAN masked at capture | STM-2026-47156 | Multi-window reconciliation |
statement_ref Correlation key | string | 6 | STM-2026-66483 | Not masked | STM-2026-66483 | Bank statement auto-match |
supplier | string | 36 | Meridian Supplies SL | Not masked | STM-2026-66483 | Bank statement auto-match |
amount_eur | money | 45 | €28,592.77 | Not masked | STM-2026-66483 | Bank statement auto-match |
cost_centre | string | 40 | CC-1701 | Not masked | STM-2026-66483 | Bank statement auto-match |
vat_code | string | 38 | S13 | Not masked | STM-2026-66483 | Bank statement auto-match |
iban | string | 40 | ES•• •••• •••• •••• 6497 | Masked at captureIBAN masked at capture | STM-2026-66483 | Bank statement auto-match |
po_number Correlation key | string | 38 | PO-2026-98862 | Not masked | PO-2026-98862 | PO ↔ invoice 3-way match |
supplier | string | 14 | Meridian Supplies SL | Not masked | PO-2026-98862 | PO ↔ invoice 3-way match |
amount_eur | money | 24 | €10,136.18 | Not masked | PO-2026-98862 | PO ↔ invoice 3-way match |
cost_centre | string | 28 | CC-2477 | Not masked | PO-2026-98862 | PO ↔ invoice 3-way match |
vat_code | string | 21 | S8 | Not masked | PO-2026-98862 | PO ↔ invoice 3-way match |
iban | string | 44 | ES•• •••• •••• •••• 5810 | Masked at captureIBAN masked at capture | PO-2026-98862 | PO ↔ invoice 3-way match |
invoice_no Correlation key | string | 6 | INV-2026-13662 | Not masked | INV-2026-13662 | Invoice re-keying (Excel → ERP) |
supplier | string | 38 | Brightline Media Srl | Not masked | INV-2026-13662 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 28 | €14,437.73 | Not masked | INV-2026-13662 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 21 | CC-4686 | Not masked | INV-2026-13662 | Invoice re-keying (Excel → ERP) |
vat_code | string | 30 | S8 | Not masked | INV-2026-13662 | Invoice re-keying (Excel → ERP) |
iban | string | 43 | ES•• •••• •••• •••• 4125 | Masked at captureIBAN masked at capture | INV-2026-13662 | Invoice re-keying (Excel → ERP) |
statement_ref Correlation key | string | 29 | STM-2026-68221 | Not masked | STM-2026-68221 | Multi-window reconciliation |
supplier | string | 15 | Havensmark Trading NV | Not masked | STM-2026-68221 | Multi-window reconciliation |
amount_eur | money | 36 | €46,713.35 | Not masked | STM-2026-68221 | Multi-window reconciliation |
cost_centre | string | 13 | CC-3880 | Not masked | STM-2026-68221 | Multi-window reconciliation |
vat_code | string | 16 | S9 | Not masked | STM-2026-68221 | Multi-window reconciliation |
iban | string | 23 | ES•• •••• •••• •••• 3063 | Masked at captureIBAN masked at capture | STM-2026-68221 | Multi-window reconciliation |
statement_ref Correlation key | string | 12 | STM-2026-23936 | Not masked | STM-2026-23936 | Bank statement auto-match |
supplier | string | 28 | Meridian Supplies SL | Not masked | STM-2026-23936 | Bank statement auto-match |
amount_eur | money | 44 | €27,697.06 | Not masked | STM-2026-23936 | Bank statement auto-match |
cost_centre | string | 24 | CC-4477 | Not masked | STM-2026-23936 | Bank statement auto-match |
vat_code | string | 48 | S15 | Not masked | STM-2026-23936 | Bank statement auto-match |
iban | string | 12 | ES•• •••• •••• •••• 5949 | Masked at captureIBAN masked at capture | STM-2026-23936 | Bank statement auto-match |
po_number Correlation key | string | 24 | PO-2026-61275 | Not masked | PO-2026-61275 | PO ↔ invoice 3-way match |
supplier | string | 8 | Nordvant Components BV | Not masked | PO-2026-61275 | PO ↔ invoice 3-way match |
amount_eur | money | 20 | €28,807.47 | Not masked | PO-2026-61275 | PO ↔ invoice 3-way match |
cost_centre | string | 41 | CC-3742 | Not masked | PO-2026-61275 | PO ↔ invoice 3-way match |
vat_code | string | 32 | S20 | Not masked | PO-2026-61275 | PO ↔ invoice 3-way match |
iban | string | 17 | ES•• •••• •••• •••• 4222 | Masked at captureIBAN masked at capture | PO-2026-61275 | PO ↔ invoice 3-way match |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 10- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 539
- Quarantined below 0.70 confidence
- 10
- Unclassified activity instances
- 6
- Blocklist pauses
- 1
- Redactions applied
- 51
- Contributed to the event log
- 91%
- 09:52–10:07 Password manager Application on the capture blocklist · 14m 56s
No recording contributes 100% of its actions — this one contributed 91%.