Skip to content

Activity Forensics

The Activity Forensics page can be used to track user activities in various areas of interest.

To locate the Activity Forensics page, navigate to Forensics > Activity.

Filter

The activity forensics filter allows users to focus on set scenarios and areas of interest.

When you open the activity forensics page, it loads with the last query used. The query is composed of one or more filters, combined with an AND operator.

Creating a Query

  1. Select a field from the Field dropdown list.
  2. Select an operator.
  3. Select or type in a value. For multiple values, start typing part of the value and select items from the dropdown list by ticking the checkbox next to each item.
  4. Select Add to add this filter to the query list.
  5. Repeat the process to add additional filter items to the query.
  6. Select Apply to run the query and display the results.

Storing and Sharing Queries

The 10 last queries are stored for reuse, with the query timestamp as the name.

You can store queries for later use, with a meaningful name, and have the option of sharing them with other users.

To store or share queries:

  1. Select the Actions dropdown menu in the top right corner.
  2. Select Save Query to open the Save Query dialog box.
  3. Type in the query name, and optionally, the name of a user(s) to share the query with.
  4. Start typing the user name. To add a user to the share list, select the + button.

Loading Stored Queries

To load a stored query, open the query list panel on the left side of the activity forensics page. You might have to click the restore button > , if this panel is minimized.

Click on a recent query or a stored query to load the query and apply it to the results.

Saving the Query to a Report

To create a report from an Activity Forensics query, select Generate Report from the Activities dropdown menu.

The report will be available in Reports > My Reports.

Creating a Scheduled Report from a Query

You can also create a repeated report from the query by selecting Schedule Report Template from the Activities dropdown menu to open the Schedule Report Template panel.