Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- WIN-OPS-04
- Department
- Operations
- Role
- Operations Lead
- Recorder reference
emp_4471- Agent version
- v2.4.1
- Operating system
- Windows 11
- Window
- 08:42–14:54 · Europe/Madrid
- Analysis state
- analyzed
Active vs idle
Active 4.6 h · 75% Waiting / idle 1.6 h · 25%
Active time is the resolved-action count times a measured mean dwell of 2.61 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
6 apps · 38 redactions · 2 capture pauses · 92.3% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
INV-2026-30575 Invoice re-keying (Excel → ERP) · 08:48–09:12 · 24m 40s RPT-2026-92071 Report export & wait · 09:12–10:08 · 55m 42s THR-2026-70653 Email → tracker copy · 09:34–11:13 · 1.7 h INV-2026-59891 Invoice re-keying (Excel → ERP) · 10:00–11:23 · 83m 40s RPT-2026-81238 Report export & wait · 10:28–11:04 · 36m 01s THR-2026-83294 Email → tracker copy · 10:51–11:21 · 30m 22s INV-2026-88695 Invoice re-keying (Excel → ERP) · 11:16–12:49 · 1.5 h RPT-2026-38191 Report export & wait · 11:41–12:05 · 24m 01s THR-2026-60014 Email → tracker copy · 12:06–12:59 · 52m 44s INV-2026-81544 Invoice re-keying (Excel → ERP) · 12:31–14:14 · 1.7 h RPT-2026-15112 Report export & wait · 13:00–14:34 · 1.6 h THR-2026-62206 Email → tracker copy · 13:24–14:39 · 75m 26s
Detected activities
OW Open workbook — 08:53, 37 resolved actions KE Key the entry into the ERP — 09:08, 57 resolved actions OR Open work item — 09:18, 56 resolved actions OW Open workbook — 09:39, 29 resolved actions FP Filter to the period — 10:00, 38 resolved actions FD File the document — 10:25, 62 resolved actions WB Wait for the report to build — 10:30, 38 resolved actions VT Validate totals — 10:31, 66 resolved actions EX Request export — 10:32, 25 resolved actions SW Switch application — 10:57, 62 resolved actions RF Reformat in the sheet — 11:03, 38 resolved actions CV Copy values between windows — 11:11, 38 resolved actions FD File the document — 11:28, 26 resolved actions FD File the document — 11:46, 44 resolved actions RB Retry the failed build — 11:54, 51 resolved actions PO Ping the owner to check — 12:44, 62 resolved actions PJ Post the journal entry — 12:45, 37 resolved actions RQ Request the missing purchase order — 12:48, 65 resolved actions RB Retry the failed build — 13:16, 35 resolved actions RF Reformat in the sheet — 13:53, 38 resolved actions
Applications
Outlook 126m
Excel 120m
CRM (web) 40m
ERP client 38m
Chrome 12m
Teams 6m
Resolved actions / min (0–32)
Phone number — 09:07 National tax id — 09:11 Card number — 09:21 Email address — 10:13 Card number — 10:31 Email address — 10:47 Phone number — 11:26 Email address — 11:57 Card number — 12:06 National tax id — 12:22 IBAN — 12:32 Free-text note — 12:45 Card number — 13:47 Free-text note — 14:13
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-07-13T08:48:06.490+02:00 | Outlook | Message detail | navigate | Button/Post | accessibility-tree | 0.98 | INV-2026-30575 |
| 2026-07-13T08:49:52.606+02:00 | ERP client | Document search | paste | Grid/Row[20]/Value | DOM | 0.78 | INV-2026-30575 |
| 2026-07-13T08:51:37.922+02:00 | ERP client | Vendor invoice — posting | navigate | Toolbar/Save | DOM | 0.77 | INV-2026-30575 |
| 2026-07-13T08:53:23.471+02:00 | Excel | Workbook · line grid | keys | typed into Amount, 19 chars | accessibility-tree | 0.95 | INV-2026-30575 |
| 2026-07-13T08:55:09.130+02:00 | ERP client | Document search | file_save | Tab/Details | accessibility-tree | 0.93 | INV-2026-30575 |
| 2026-07-13T08:56:55.887+02:00 | Excel | Workbook · line grid | paste | Grid/Row[24]/Value | accessibility-tree | 0.96 | INV-2026-30575 |
| 2026-07-13T09:34:08.980+02:00 | Outlook | Inbox | keys | typed into Reference, 12 chars | DOM | 0.76 | THR-2026-70653 |
| 2026-07-13T09:36:49.112+02:00 | ERP client | Vendor invoice — posting | paste | Field/Reference | accessibility-tree | 0.94 | RPT-2026-92071 |
| 2026-07-13T09:40:48.851+02:00 | CRM (web) | Activity log | click | Grid/Row[24]/Value | accessibility-tree | 0.9 | RPT-2026-92071 |
| 2026-07-13T09:41:13.093+02:00 | Excel | Workbook · summary | focus | Button/Post | DOM | 0.86 | THR-2026-70653 |
| 2026-07-13T09:44:47.864+02:00 | CRM (web) | Opportunity detail | navigate | Field/Reference | accessibility-tree | 0.88 | RPT-2026-92071 |
| 2026-07-13T09:48:18.794+02:00 | Excel | Workbook · line grid | keys | typed into Cost centre, 27 chars | OCR fallback | 0.67 | THR-2026-70653 |
| 2026-07-13T09:48:45.870+02:00 | CRM (web) | Account record | click | Toolbar/Save | DOM | 0.83 | RPT-2026-92071 |
| 2026-07-13T09:52:44.955+02:00 | CRM (web) | Account record | keys | typed into Subject, 36 chars | DOM | 0.81 | RPT-2026-92071 |
| 2026-07-13T09:55:22.042+02:00 | Excel | Workbook · line grid | focus | Button/Post | accessibility-tree | 0.9 | THR-2026-70653 |
| 2026-07-13T09:56:43.240+02:00 | CRM (web) | Activity log | navigate | Tab/Details | accessibility-tree | 0.93 | RPT-2026-92071 |
| 2026-07-13T10:24:08.542+02:00 | ERP client | Vendor invoice — posting | navigate | Tab/Details | DOM | 0.85 | INV-2026-59891 |
| 2026-07-13T10:28:01.891+02:00 | ERP client | Vendor invoice — posting | click | Field/Reference | accessibility-tree | 0.98 | RPT-2026-81238 |
| 2026-07-13T10:30:07.333+02:00 | ERP client | Document search | click | Tab/Details | accessibility-tree | 0.97 | INV-2026-59891 |
| 2026-07-13T10:30:35.561+02:00 | ERP client | Cost centre lookup | scroll | Tab/Details | DOM | 0.8 | RPT-2026-81238 |
| 2026-07-13T10:36:05.338+02:00 | ERP client | Cost centre lookup | focus | Button/Post | accessibility-tree | 0.98 | INV-2026-59891 |
| 2026-07-13T10:42:04.106+02:00 | ERP client | Cost centre lookup | keys | typed into Due date, 17 chars | DOM | 0.81 | INV-2026-59891 |
| 2026-07-13T10:48:03.578+02:00 | Excel | Workbook · summary | paste | Tab/Details | OCR fallback | 0.51 | INV-2026-59891 |
| 2026-07-13T10:53:45.567+02:00 | ERP client | Cost centre lookup | scroll | Field/Reference | DOM | 0.73 | RPT-2026-81238 |
| 2026-07-13T10:54:01.839+02:00 | Outlook | Inbox | scroll | Button/Post | accessibility-tree | 0.88 | INV-2026-59891 |
| 2026-07-13T10:55:50.808+02:00 | Excel | Workbook · line grid | navigate | Tab/Details | accessibility-tree | 0.88 | THR-2026-83294 |
| 2026-07-13T10:56:19.074+02:00 | Chrome | Internal wiki | focus | Toolbar/Save | DOM | 0.78 | RPT-2026-81238 |
| 2026-07-13T10:58:00.095+02:00 | Outlook | Draft | scroll | Button/Post | DOM | 0.83 | THR-2026-83294 |
| 2026-07-13T10:58:53.191+02:00 | ERP client | Cost centre lookup | focus | Toolbar/Save | accessibility-tree | 0.98 | RPT-2026-81238 |
| 2026-07-13T10:59:05.824+02:00 | Outlook | Message detail | focus | Tab/Details | accessibility-tree | 0.94 | THR-2026-70653 |
| 2026-07-13T11:00:11.810+02:00 | Outlook | Message detail | scroll | Toolbar/Save | DOM | 0.79 | THR-2026-83294 |
| 2026-07-13T11:01:28.667+02:00 | ERP client | Vendor invoice — posting | navigate | Toolbar/Save | accessibility-tree | 0.94 | RPT-2026-81238 |
| 2026-07-13T11:02:21.897+02:00 | Outlook | Message detail | file_save | Button/Post | accessibility-tree | 0.89 | THR-2026-83294 |
| 2026-07-13T11:04:31.463+02:00 | Excel | Workbook · summary | click | Field/Reference | DOM | 0.87 | THR-2026-83294 |
| 2026-07-13T11:06:10.433+02:00 | Outlook | Inbox | keys | typed into Subject, 32 chars | DOM | 0.84 | THR-2026-70653 |
| 2026-07-13T11:06:41.054+02:00 | Excel | Pivot view | navigate | Grid/Row[11]/Value | DOM | 0.83 | THR-2026-83294 |
| 2026-07-13T11:41:45.376+02:00 | ERP client | Vendor invoice — posting | click | Button/Post | accessibility-tree | 0.89 | RPT-2026-38191 |
| 2026-07-13T11:43:28.314+02:00 | CRM (web) | Activity log | scroll | Field/Reference | accessibility-tree | 0.92 | RPT-2026-38191 |
| 2026-07-13T11:45:11.391+02:00 | Chrome | Internal wiki | keys | typed into Cost centre, 3 chars | accessibility-tree | 0.89 | RPT-2026-38191 |
| 2026-07-13T11:46:54.249+02:00 | Chrome | Report export | click | Link/Open | accessibility-tree | 0.98 | RPT-2026-38191 |
| 2026-07-13T11:48:37.854+02:00 | Chrome | Internal wiki | focus | Toolbar/Save | accessibility-tree | 0.94 | RPT-2026-38191 |
| 2026-07-13T11:50:20.039+02:00 | ERP client | Document search | focus | Link/Open | accessibility-tree | 0.92 | RPT-2026-38191 |
| 2026-07-13T12:09:24.919+02:00 | ERP client | Document search | focus | Button/Post | DOM | 0.74 | INV-2026-88695 |
| 2026-07-13T12:16:01.059+02:00 | ERP client | Vendor invoice — posting | scroll | Field/Reference | DOM | 0.87 | INV-2026-88695 |
| 2026-07-13T12:22:39.433+02:00 | ERP client | Cost centre lookup | paste | Button/Post | DOM | 0.76 | INV-2026-88695 |
| 2026-07-13T12:29:16.556+02:00 | ERP client | Vendor invoice — posting | focus | Field/Reference | accessibility-tree | 0.94 | INV-2026-88695 |
| 2026-07-13T12:29:17.374+02:00 | Excel | Pivot view | click | Button/Post | accessibility-tree | 0.97 | THR-2026-60014 |
| 2026-07-13T12:31:27.975+02:00 | Excel | Workbook · summary | navigate | Tab/Details | accessibility-tree | 0.88 | INV-2026-81544 |
| 2026-07-13T12:33:03.085+02:00 | Outlook | Inbox | Field/Reference | DOM | 0.72 | THR-2026-60014 | |
| 2026-07-13T12:35:54.305+02:00 | Excel | Workbook · line grid | click | Tab/Details | accessibility-tree | 1 | INV-2026-88695 |
| 2026-07-13T12:36:49.554+02:00 | Excel | Pivot view | scroll | Button/Post | accessibility-tree | 0.91 | THR-2026-60014 |
| 2026-07-13T12:38:48.006+02:00 | Excel | Workbook · line grid | navigate | Toolbar/Save | accessibility-tree | 0.88 | INV-2026-81544 |
| 2026-07-13T12:40:35.609+02:00 | Outlook | Draft | file_save | Toolbar/Save | accessibility-tree | 0.92 | THR-2026-60014 |
| 2026-07-13T12:42:31.414+02:00 | Excel | Pivot view | Tab/Details | OCR fallback | 0.38 | INV-2026-88695 | |
| 2026-07-13T12:44:21.046+02:00 | Outlook | Draft | scroll | Toolbar/Save | accessibility-tree | 0.94 | THR-2026-60014 |
| 2026-07-13T12:46:09.963+02:00 | ERP client | Vendor invoice — posting | Tab/Details | accessibility-tree | 0.93 | INV-2026-81544 | |
| 2026-07-13T12:48:07.366+02:00 | Outlook | Message detail | file_save | Field/Reference | DOM | 0.77 | THR-2026-60014 |
| 2026-07-13T12:53:29.231+02:00 | ERP client | Cost centre lookup | Link/Open | DOM | 0.75 | INV-2026-81544 | |
| 2026-07-13T13:24:18.072+02:00 | Excel | Pivot view | scroll | Field/Reference | DOM | 0.81 | THR-2026-62206 |
| 2026-07-13T13:27:24.876+02:00 | ERP client | Cost centre lookup | Tab/Details | DOM | 0.81 | RPT-2026-15112 | |
| 2026-07-13T13:29:41.342+02:00 | Outlook | Message detail | paste | Field/Reference | accessibility-tree | 0.93 | THR-2026-62206 |
| 2026-07-13T13:34:08.357+02:00 | ERP client | Document search | paste | Grid/Row[3]/Value | accessibility-tree | 0.97 | RPT-2026-15112 |
| 2026-07-13T13:40:53.802+02:00 | ERP client | Vendor invoice — posting | Tab/Details | OCR fallback | 0.69 | RPT-2026-15112 | |
| 2026-07-13T13:47:37.128+02:00 | ERP client | Cost centre lookup | focus | Grid/Row[10]/Value | accessibility-tree | 0.91 | RPT-2026-15112 |
| 2026-07-13T13:54:21.889+02:00 | Chrome | Supplier portal | focus | Tab/Details | DOM | 0.71 | RPT-2026-15112 |
| 2026-07-13T13:59:36.389+02:00 | ERP client | Vendor invoice — posting | file_save | Field/Reference | DOM | 0.7 | INV-2026-81544 |
| 2026-07-13T14:01:06.398+02:00 | Chrome | Report export | paste | Grid/Row[10]/Value | DOM | 0.82 | RPT-2026-15112 |
| 2026-07-13T14:06:57.818+02:00 | Outlook | Message detail | click | Link/Open | DOM | 0.87 | INV-2026-81544 |
| 2026-07-13T14:18:11.377+02:00 | Excel | Workbook · line grid | click | Toolbar/Save | DOM | 0.78 | THR-2026-62206 |
| 2026-07-13T14:23:34.205+02:00 | Excel | Pivot view | keys | typed into Reference, 34 chars | DOM | 0.71 | THR-2026-62206 |
| 2026-07-13T14:28:57.477+02:00 | Excel | Workbook · summary | Toolbar/Save | accessibility-tree | 0.95 | THR-2026-62206 | |
| 2026-07-13T14:34:21.156+02:00 | Outlook | Message detail | navigate | Button/Post | accessibility-tree | 1 | THR-2026-62206 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 46| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
invoice_no Correlation key | string | 26 | INV-2026-30575 | Not masked | INV-2026-30575 | Invoice re-keying (Excel → ERP) |
supplier | string | 37 | Orbita Serveis SCP | Not masked | INV-2026-30575 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 27 | €41,434.32 | Not masked | INV-2026-30575 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 23 | CC-4417 | Not masked | INV-2026-30575 | Invoice re-keying (Excel → ERP) |
vat_code | string | 48 | S2 | Not masked | INV-2026-30575 | Invoice re-keying (Excel → ERP) |
iban | string | 44 | ES•• •••• •••• •••• 5702 | Masked at captureIBAN masked at capture | INV-2026-30575 | Invoice re-keying (Excel → ERP) |
report_ref Correlation key | string | 42 | RPT-2026-92071 | Not masked | RPT-2026-92071 | Report export & wait |
account | string | 15 | Meridian Supplies SL | Not masked | RPT-2026-92071 | Report export & wait |
amount_eur | money | 31 | €5,223.5 | Not masked | RPT-2026-92071 | Report export & wait |
region | string | 27 | DACH | Not masked | RPT-2026-92071 | Report export & wait |
owner_role | string | 32 | Sales Ops | Not masked | RPT-2026-92071 | Report export & wait |
contact_phone | string | 15 | +34 ••• ••• 812 | Masked at capturePhone number masked at capture | RPT-2026-92071 | Report export & wait |
thread_id Correlation key | string | 27 | THR-2026-70653 | Not masked | THR-2026-70653 | Email → tracker copy |
queue | string | 37 | Billing | Not masked | THR-2026-70653 | Email → tracker copy |
priority | string | 23 | P2 | Not masked | THR-2026-70653 | Email → tracker copy |
requester_ref | string | 40 | cust_7339 | Not masked | THR-2026-70653 | Email → tracker copy |
contact_email | string | 24 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | THR-2026-70653 | Email → tracker copy |
invoice_no Correlation key | string | 9 | INV-2026-59891 | Not masked | INV-2026-59891 | Invoice re-keying (Excel → ERP) |
supplier | string | 40 | Nordvant Components BV | Not masked | INV-2026-59891 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 35 | €30,228.69 | Not masked | INV-2026-59891 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 42 | CC-3072 | Not masked | INV-2026-59891 | Invoice re-keying (Excel → ERP) |
vat_code | string | 6 | S12 | Not masked | INV-2026-59891 | Invoice re-keying (Excel → ERP) |
iban | string | 38 | ES•• •••• •••• •••• 2581 | Masked at captureIBAN masked at capture | INV-2026-59891 | Invoice re-keying (Excel → ERP) |
report_ref Correlation key | string | 29 | RPT-2026-81238 | Not masked | RPT-2026-81238 | Report export & wait |
account | string | 32 | Nordvant Components BV | Not masked | RPT-2026-81238 | Report export & wait |
amount_eur | money | 17 | €8,976.55 | Not masked | RPT-2026-81238 | Report export & wait |
region | string | 39 | Iberia | Not masked | RPT-2026-81238 | Report export & wait |
owner_role | string | 24 | Sales Ops | Not masked | RPT-2026-81238 | Report export & wait |
contact_phone | string | 34 | +34 ••• ••• 600 | Masked at capturePhone number masked at capture | RPT-2026-81238 | Report export & wait |
thread_id Correlation key | string | 16 | THR-2026-83294 | Not masked | THR-2026-83294 | Email → tracker copy |
queue | string | 16 | Tier 2 | Not masked | THR-2026-83294 | Email → tracker copy |
priority | string | 11 | P3 | Not masked | THR-2026-83294 | Email → tracker copy |
requester_ref | string | 14 | cust_3408 | Not masked | THR-2026-83294 | Email → tracker copy |
contact_email | string | 26 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | THR-2026-83294 | Email → tracker copy |
invoice_no Correlation key | string | 29 | INV-2026-88695 | Not masked | INV-2026-88695 | Invoice re-keying (Excel → ERP) |
supplier | string | 19 | Nordvant Components BV | Not masked | INV-2026-88695 | Invoice re-keying (Excel → ERP) |
amount_eur | money | 21 | €25,539.73 | Not masked | INV-2026-88695 | Invoice re-keying (Excel → ERP) |
cost_centre | string | 7 | CC-1728 | Not masked | INV-2026-88695 | Invoice re-keying (Excel → ERP) |
vat_code | string | 36 | S5 | Not masked | INV-2026-88695 | Invoice re-keying (Excel → ERP) |
iban | string | 47 | ES•• •••• •••• •••• 3095 | Masked at captureIBAN masked at capture | INV-2026-88695 | Invoice re-keying (Excel → ERP) |
report_ref Correlation key | string | 31 | RPT-2026-38191 | Not masked | RPT-2026-38191 | Report export & wait |
account | string | 10 | Vallcarca Tecnics SL | Not masked | RPT-2026-38191 | Report export & wait |
amount_eur | money | 23 | €16,378.23 | Not masked | RPT-2026-38191 | Report export & wait |
region | string | 28 | Iberia | Not masked | RPT-2026-38191 | Report export & wait |
owner_role | string | 35 | Sales Ops | Not masked | RPT-2026-38191 | Report export & wait |
contact_phone | string | 6 | +34 ••• ••• 828 | Masked at capturePhone number masked at capture | RPT-2026-38191 | Report export & wait |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 12- Masked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 494
- Quarantined below 0.70 confidence
- 4
- Unclassified activity instances
- 6
- Blocklist pauses
- 2
- Redactions applied
- 38
- Contributed to the event log
- 92.3%
- 10:03–10:17 Password manager Application on the capture blocklist · 13m 53s
- 12:20–12:26 Banking Application on the capture blocklist · 6m 04s
No recording contributes 100% of its actions — this one contributed 92.3%.