Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- WIN-SUP-01
- Department
- Customer Support
- Role
- Support Lead
- Recorder reference
emp_5164- Agent version
- v2.4.1
- Operating system
- Windows 11
- Window
- 08:12–15:33 · Europe/Madrid
- Analysis state
- processing
Active vs idle
Active 5.3 h · 72% Waiting / idle 2.1 h · 28%
Active time is the resolved-action count times a measured mean dwell of 2.41 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
6 apps · 17 redactions · 1 capture pauses · 92.2% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
TCK-2026-19242 Ticket triage & canned replies · 08:13–08:57 · 43m 34s TCK-2026-71207 SLA breach alerts · 08:35–10:37 · 2 h RPT-2026-78258 Scheduled report delivery · 09:00–10:49 · 1.8 h TCK-2026-36283 Ticket triage & canned replies · 09:21–11:17 · 1.9 h TCK-2026-94156 SLA breach alerts · 09:48–11:11 · 82m 41s RPT-2026-62330 Scheduled report delivery · 10:06–10:45 · 38m 45s TCK-2026-87182 Ticket triage & canned replies · 10:31–11:58 · 87m 24s TCK-2026-56793 SLA breach alerts · 10:50–11:21 · 31m 16s RPT-2026-61706 Scheduled report delivery · 11:15–12:35 · 80m 14s TCK-2026-67249 Ticket triage & canned replies · 11:35–13:02 · 86m 39s TCK-2026-12432 SLA breach alerts · 12:04–13:29 · 84m 23s RPT-2026-20237 Scheduled report delivery · 12:26–13:26 · 59m 59s TCK-2026-23689 Ticket triage & canned replies · 12:45–13:53 · 68m 10s TCK-2026-75465 SLA breach alerts · 13:09–14:21 · 72m 12s RPT-2026-75837 Scheduled report delivery · 13:28–14:08 · 40m TCK-2026-89596 Ticket triage & canned replies · 13:56–15:33 · 1.6 h
Detected activities
PC Post a handoff note — 08:21, 49 resolved actions AK Acknowledge the alert — 08:44, 56 resolved actions LO Look up the order status — 08:44, 63 resolved actions AF Alert Ops about the failure — 09:25, 56 resolved actions RK Re-check the SLA clock — 09:38, 25 resolved actions RS Resolve the ticket — 09:57, 42 resolved actions RB Retry the failed build — 10:11, 22 resolved actions SK Scan for SLA risk — 10:17, 43 resolved actions FS Schedule fires — 10:19, 54 resolved actions DF Download file — 10:42, 41 resolved actions RS Resolve the ticket — 10:48, 66 resolved actions LO Look up the order status — 10:55, 48 resolved actions CT Classify intent and priority — 11:15, 38 resolved actions RS Resolve the ticket — 11:18, 29 resolved actions AF Alert Ops about the failure — 11:55, 57 resolved actions PM Paste a canned reply — 12:14, 51 resolved actions RB Retry the failed build — 12:33, 50 resolved actions AO Alert the owner — 13:08, 59 resolved actions EM Edit the canned reply — 13:25, 67 resolved actions OQ Open the ticket queue — 13:37, 65 resolved actions AF Alert Ops about the failure — 13:37, 56 resolved actions TR Tag and route — 15:08, 48 resolved actions
Applications
Chrome 588m
Zendesk 505m
Confluence 262m
Excel 208m
Teams 176m
Outlook 121m
Resolved actions / min (0–33)
Phone number — 08:34 Free-text note — 09:30 IBAN — 10:12 Free-text note — 11:17 Card number — 11:26 Free-text note — 11:28 National tax id — 11:33 Free-text note — 12:02 IBAN — 12:13 Phone number — 13:06 Phone number — 13:36 IBAN — 14:39 Email address — 14:47 Phone number — 14:59
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-07-10T08:13:41.726+02:00 | Chrome | Internal wiki | file_save | Tab/Details | accessibility-tree | 0.98 | TCK-2026-19242 |
| 2026-07-10T08:16:48.889+02:00 | Confluence | Process page | click | Toolbar/Save | DOM | 0.84 | TCK-2026-19242 |
| 2026-07-10T08:19:54.523+02:00 | Zendesk | Queue view | Toolbar/Save | accessibility-tree | 0.91 | TCK-2026-19242 | |
| 2026-07-10T08:23:01.409+02:00 | Teams | Channel thread | paste | Grid/Row[2]/Value | DOM | 0.87 | TCK-2026-19242 |
| 2026-07-10T08:26:08.379+02:00 | Zendesk | Macro picker | scroll | Toolbar/Save | accessibility-tree | 0.94 | TCK-2026-19242 |
| 2026-07-10T09:18:39.906+02:00 | Outlook | Message detail | navigate | Toolbar/Save | accessibility-tree | 0.96 | TCK-2026-71207 |
| 2026-07-10T09:21:00.701+02:00 | Zendesk | Macro picker | navigate | Link/Open | OCR fallback | 0.68 | TCK-2026-36283 |
| 2026-07-10T09:27:22.053+02:00 | Chrome | Report export | scroll | Field/Reference | DOM | 0.84 | TCK-2026-71207 |
| 2026-07-10T09:29:21.395+02:00 | Confluence | Runbook | Tab/Details | DOM | 0.86 | TCK-2026-36283 | |
| 2026-07-10T09:36:06.752+02:00 | Chrome | Report export | keys | typed into Cost centre, 33 chars | OCR fallback | 0.24 | TCK-2026-71207 |
| 2026-07-10T09:37:43.253+02:00 | Outlook | Inbox | keys | typed into Subject, 19 chars | accessibility-tree | 0.97 | TCK-2026-36283 |
| 2026-07-10T09:44:50.682+02:00 | Teams | Direct message | keys | typed into Vendor name, 21 chars | DOM | 0.72 | TCK-2026-71207 |
| 2026-07-10T09:46:04.367+02:00 | Chrome | Report export | paste | Button/Post | DOM | 0.87 | TCK-2026-36283 |
| 2026-07-10T10:10:17.634+02:00 | Chrome | Internal wiki | click | Button/Post | DOM | 0.79 | RPT-2026-78258 |
| 2026-07-10T10:12:01.770+02:00 | Confluence | Runbook | focus | Tab/Details | DOM | 0.76 | TCK-2026-94156 |
| 2026-07-10T10:17:56.378+02:00 | Confluence | Process page | Link/Open | DOM | 0.72 | TCK-2026-94156 | |
| 2026-07-10T10:18:04.209+02:00 | Zendesk | Ticket detail | paste | Grid/Row[14]/Value | accessibility-tree | 0.94 | RPT-2026-78258 |
| 2026-07-10T10:23:50.297+02:00 | Zendesk | Queue view | click | Grid/Row[8]/Value | OCR fallback | 0.59 | TCK-2026-94156 |
| 2026-07-10T10:25:50.631+02:00 | Zendesk | Queue view | navigate | Tab/Details | DOM | 0.79 | RPT-2026-78258 |
| 2026-07-10T10:29:45.586+02:00 | Outlook | Draft | Toolbar/Save | accessibility-tree | 0.92 | TCK-2026-94156 | |
| 2026-07-10T10:31:11.016+02:00 | Excel | Workbook · summary | file_save | Link/Open | DOM | 0.73 | RPT-2026-62330 |
| 2026-07-10T10:31:14.756+02:00 | Outlook | Message detail | Grid/Row[23]/Value | accessibility-tree | 0.97 | TCK-2026-87182 | |
| 2026-07-10T10:33:37.153+02:00 | Zendesk | Queue view | navigate | Link/Open | accessibility-tree | 0.92 | RPT-2026-78258 |
| 2026-07-10T10:33:57.037+02:00 | Excel | Pivot view | navigate | Grid/Row[13]/Value | accessibility-tree | 0.96 | RPT-2026-62330 |
| 2026-07-10T10:35:39.499+02:00 | Chrome | Report export | click | Tab/Details | accessibility-tree | 0.91 | TCK-2026-94156 |
| 2026-07-10T10:36:43.790+02:00 | Outlook | Draft | keys | typed into Cost centre, 23 chars | DOM | 0.78 | RPT-2026-62330 |
| 2026-07-10T10:37:29.456+02:00 | Confluence | Process page | Button/Post | DOM | 0.82 | TCK-2026-87182 | |
| 2026-07-10T10:39:29.399+02:00 | Teams | Direct message | keys | typed into Amount, 14 chars | accessibility-tree | 1 | RPT-2026-62330 |
| 2026-07-10T10:41:23.034+02:00 | Zendesk | Macro picker | file_save | Link/Open | DOM | 0.81 | RPT-2026-78258 |
| 2026-07-10T10:43:43.868+02:00 | Excel | Workbook · summary | click | Link/Open | accessibility-tree | 0.9 | TCK-2026-87182 |
| 2026-07-10T10:49:58.586+02:00 | Confluence | Process page | focus | Field/Reference | accessibility-tree | 0.96 | TCK-2026-87182 |
| 2026-07-10T10:59:26.060+02:00 | Excel | Workbook · line grid | paste | Grid/Row[7]/Value | DOM | 0.79 | TCK-2026-56793 |
| 2026-07-10T11:01:40.343+02:00 | Zendesk | Ticket detail | paste | Tab/Details | accessibility-tree | 0.91 | TCK-2026-56793 |
| 2026-07-10T11:03:54.791+02:00 | Zendesk | Macro picker | scroll | Button/Post | OCR fallback | 0.69 | TCK-2026-56793 |
| 2026-07-10T11:06:08.044+02:00 | Teams | Channel thread | focus | Field/Reference | DOM | 0.78 | TCK-2026-56793 |
| 2026-07-10T11:35:49.457+02:00 | Chrome | Internal wiki | keys | typed into Subject, 40 chars | DOM | 0.72 | TCK-2026-67249 |
| 2026-07-10T11:42:00.683+02:00 | Zendesk | Macro picker | click | Tab/Details | accessibility-tree | 0.89 | TCK-2026-67249 |
| 2026-07-10T11:48:12.389+02:00 | Confluence | Runbook | paste | Field/Reference | accessibility-tree | 0.93 | TCK-2026-67249 |
| 2026-07-10T11:52:23.431+02:00 | Outlook | Message detail | Button/Post | accessibility-tree | 0.94 | TCK-2026-87182 | |
| 2026-07-10T12:01:23.547+02:00 | Chrome | Report export | paste | Toolbar/Save | DOM | 0.77 | RPT-2026-61706 |
| 2026-07-10T12:07:07.912+02:00 | Excel | Workbook · summary | Field/Reference | DOM | 0.87 | RPT-2026-61706 | |
| 2026-07-10T12:12:51.613+02:00 | Excel | Pivot view | scroll | Tab/Details | OCR fallback | 0.61 | RPT-2026-61706 |
| 2026-07-10T12:18:34.071+02:00 | Teams | Direct message | scroll | Field/Reference | accessibility-tree | 1 | RPT-2026-61706 |
| 2026-07-10T12:22:58.791+02:00 | Zendesk | Macro picker | keys | typed into Due date, 36 chars | accessibility-tree | 0.89 | TCK-2026-12432 |
| 2026-07-10T12:24:18.139+02:00 | Teams | Direct message | navigate | Toolbar/Save | DOM | 0.81 | RPT-2026-61706 |
| 2026-07-10T12:29:00.126+02:00 | Zendesk | Queue view | focus | Toolbar/Save | accessibility-tree | 0.98 | TCK-2026-12432 |
| 2026-07-10T12:35:01.528+02:00 | Teams | Direct message | paste | Grid/Row[9]/Value | accessibility-tree | 0.9 | TCK-2026-12432 |
| 2026-07-10T12:41:03.610+02:00 | Outlook | Message detail | Field/Reference | DOM | 0.82 | TCK-2026-12432 | |
| 2026-07-10T12:45:31.229+02:00 | Excel | Workbook · summary | file_save | Grid/Row[9]/Value | DOM | 0.73 | TCK-2026-23689 |
| 2026-07-10T12:47:05.793+02:00 | Outlook | Draft | paste | Field/Reference | DOM | 0.77 | TCK-2026-12432 |
| 2026-07-10T12:50:23.515+02:00 | Confluence | Runbook | click | Button/Post | accessibility-tree | 0.91 | TCK-2026-23689 |
| 2026-07-10T12:55:15.122+02:00 | Chrome | Internal wiki | scroll | Link/Open | accessibility-tree | 0.93 | TCK-2026-23689 |
| 2026-07-10T12:56:17.505+02:00 | Teams | Direct message | Field/Reference | accessibility-tree | 0.98 | TCK-2026-67249 | |
| 2026-07-10T13:00:54.361+02:00 | Confluence | Process page | navigate | Link/Open | accessibility-tree | 0.92 | RPT-2026-20237 |
| 2026-07-10T13:05:11.252+02:00 | Excel | Workbook · line grid | scroll | Field/Reference | accessibility-tree | 0.93 | RPT-2026-20237 |
| 2026-07-10T13:09:28.636+02:00 | Zendesk | Queue view | click | Link/Open | DOM | 0.8 | RPT-2026-20237 |
| 2026-07-10T13:13:45.730+02:00 | Teams | Direct message | navigate | Tab/Details | DOM | 0.75 | RPT-2026-20237 |
| 2026-07-10T13:24:46.145+02:00 | Chrome | Supplier portal | paste | Tab/Details | accessibility-tree | 0.92 | TCK-2026-75465 |
| 2026-07-10T13:29:56.980+02:00 | Outlook | Inbox | click | Toolbar/Save | DOM | 0.75 | TCK-2026-75465 |
| 2026-07-10T13:35:05.630+02:00 | Excel | Workbook · line grid | file_save | Button/Post | accessibility-tree | 0.98 | TCK-2026-75465 |
| 2026-07-10T13:40:15.864+02:00 | Chrome | Internal wiki | click | Toolbar/Save | DOM | 0.86 | TCK-2026-75465 |
| 2026-07-10T13:43:57.559+02:00 | Chrome | Supplier portal | scroll | Link/Open | DOM | 0.8 | TCK-2026-23689 |
| 2026-07-10T13:48:39.161+02:00 | Excel | Workbook · line grid | navigate | Link/Open | accessibility-tree | 0.97 | RPT-2026-75837 |
| 2026-07-10T13:48:49.002+02:00 | Chrome | Supplier portal | focus | Button/Post | DOM | 0.87 | TCK-2026-23689 |
| 2026-07-10T13:51:30.844+02:00 | Confluence | Process page | file_save | Grid/Row[16]/Value | accessibility-tree | 0.88 | RPT-2026-75837 |
| 2026-07-10T13:54:22.813+02:00 | Excel | Workbook · summary | file_save | Grid/Row[13]/Value | accessibility-tree | 0.88 | RPT-2026-75837 |
| 2026-07-10T13:56:31.875+02:00 | Teams | Direct message | Button/Post | accessibility-tree | 0.98 | TCK-2026-89596 | |
| 2026-07-10T13:57:13.486+02:00 | Confluence | Process page | paste | Toolbar/Save | accessibility-tree | 0.91 | RPT-2026-75837 |
| 2026-07-10T14:00:05.467+02:00 | Outlook | Inbox | scroll | Toolbar/Save | accessibility-tree | 0.9 | RPT-2026-75837 |
| 2026-07-10T14:03:25.065+02:00 | Teams | Direct message | scroll | Field/Reference | accessibility-tree | 0.91 | TCK-2026-89596 |
| 2026-07-10T15:19:13.973+02:00 | Chrome | Internal wiki | file_save | Grid/Row[22]/Value | DOM | 0.84 | TCK-2026-89596 |
| 2026-07-10T15:26:07.070+02:00 | Teams | Direct message | click | Field/Reference | DOM | 0.82 | TCK-2026-89596 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 42| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
ticket_id Correlation key | string | 16 | TCK-2026-19242 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
queue | string | 35 | Tier 2 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
priority | string | 30 | P1 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
requester_ref | string | 42 | cust_7492 | Not masked | TCK-2026-19242 | Ticket triage & canned replies |
contact_email | string | 8 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-19242 | Ticket triage & canned replies |
ticket_id Correlation key | string | 48 | TCK-2026-71207 | Not masked | TCK-2026-71207 | SLA breach alerts |
queue | string | 46 | Tier 2 | Not masked | TCK-2026-71207 | SLA breach alerts |
priority | string | 12 | P2 | Not masked | TCK-2026-71207 | SLA breach alerts |
requester_ref | string | 21 | cust_7692 | Not masked | TCK-2026-71207 | SLA breach alerts |
contact_email | string | 46 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-71207 | SLA breach alerts |
report_ref Correlation key | string | 17 | RPT-2026-78258 | Not masked | RPT-2026-78258 | Scheduled report delivery |
account | string | 23 | Atlas Papeleria SA | Not masked | RPT-2026-78258 | Scheduled report delivery |
amount_eur | money | 33 | €26,195.35 | Not masked | RPT-2026-78258 | Scheduled report delivery |
region | string | 44 | Iberia | Not masked | RPT-2026-78258 | Scheduled report delivery |
owner_role | string | 23 | Sales Ops | Not masked | RPT-2026-78258 | Scheduled report delivery |
contact_phone | string | 14 | +34 ••• ••• 475 | Masked at capturePhone number masked at capture | RPT-2026-78258 | Scheduled report delivery |
ticket_id Correlation key | string | 44 | TCK-2026-36283 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
queue | string | 29 | Tier 2 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
priority | string | 18 | P3 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
requester_ref | string | 36 | cust_1264 | Not masked | TCK-2026-36283 | Ticket triage & canned replies |
contact_email | string | 19 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-36283 | Ticket triage & canned replies |
ticket_id Correlation key | string | 45 | TCK-2026-94156 | Not masked | TCK-2026-94156 | SLA breach alerts |
queue | string | 24 | Tier 2 | Not masked | TCK-2026-94156 | SLA breach alerts |
priority | string | 44 | P3 | Not masked | TCK-2026-94156 | SLA breach alerts |
requester_ref | string | 26 | cust_8082 | Not masked | TCK-2026-94156 | SLA breach alerts |
contact_email | string | 43 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-94156 | SLA breach alerts |
report_ref Correlation key | string | 13 | RPT-2026-62330 | Not masked | RPT-2026-62330 | Scheduled report delivery |
account | string | 37 | Brightline Media Srl | Not masked | RPT-2026-62330 | Scheduled report delivery |
amount_eur | money | 18 | €19,568.24 | Not masked | RPT-2026-62330 | Scheduled report delivery |
region | string | 37 | Iberia | Not masked | RPT-2026-62330 | Scheduled report delivery |
owner_role | string | 43 | Sales Ops | Not masked | RPT-2026-62330 | Scheduled report delivery |
contact_phone | string | 18 | +34 ••• ••• 320 | Masked at capturePhone number masked at capture | RPT-2026-62330 | Scheduled report delivery |
ticket_id Correlation key | string | 19 | TCK-2026-87182 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
queue | string | 31 | Tier 2 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
priority | string | 45 | P3 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
requester_ref | string | 21 | cust_3728 | Not masked | TCK-2026-87182 | Ticket triage & canned replies |
contact_email | string | 38 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-87182 | Ticket triage & canned replies |
ticket_id Correlation key | string | 29 | TCK-2026-56793 | Not masked | TCK-2026-56793 | SLA breach alerts |
queue | string | 29 | Tier 2 | Not masked | TCK-2026-56793 | SLA breach alerts |
priority | string | 48 | P3 | Not masked | TCK-2026-56793 | SLA breach alerts |
requester_ref | string | 45 | cust_2910 | Not masked | TCK-2026-56793 | SLA breach alerts |
contact_email | string | 22 | •••••••@•••••.••• | Masked at captureEmail address masked at capture | TCK-2026-56793 | SLA breach alerts |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 10- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 617
- Quarantined below 0.70 confidence
- 5
- Unclassified activity instances
- 7
- Blocklist pauses
- 1
- Redactions applied
- 17
- Contributed to the event log
- 92.2%
- 09:53–10:06 Password manager Application on the capture blocklist · 12m 43s
No recording contributes 100% of its actions — this one contributed 92.2%.