Employee Monitoring: Activity - Detailed Activity
Objective. Read the Detailed Activity log: name every column of the per-activity table, explain what the Screens and idle-flag columns add, drive the Productive/Non-Productive/Neutral filter, and investigate a single row with context rather than presenting it as a conclusion.
Detailed Activity is the lowest-level, row-by-row log of what happened on which machine: each entry is one activity on one computer by one user, with its exact window title, app, duration, idle time, screen count and an idle flag. It is the evidence page you land on when a higher-level number raises a question - and it is also where the 'signal not verdict' discipline matters most, because this is the granular, person-level detail.
See it in the demo
What this page answers
Detailed Activity answers for the chosen day, show me the actual individual activities - who, on which computer, in which app, for how long, and how much of it was idle? It is the forensic layer: a manager or CSM comes here from a higher-level signal (a surprising category share, an off-looking person on the Overview or live board) to see the concrete entries behind it. It is the closest thing to 'show me exactly what happened' short of screenshots.
Controls: a Day period selector, the date, and a GMT timezone control, plus a Productive / Non-Productive / Neutral classification filter (the 'select All' control) to narrow the log to one class of activity. It sits in the Activity tab-strip alongside Intensity Graph and Apps & Urls.
On the page, panel by panel
Detailed Activity log - one row per captured activity, columns: Productivity (the classification pill - Productive / Non-Productive / Neutral), Date (timestamp of the activity), Computer (the machine name, e.g. ANTHONY-LAPTOP, ERIC-PC - this ties the activity to a device, not just a person), User (the employee), Duration (how long the activity ran, hh:mm:ss), Screens (how many screenshots/screen captures are attached to this activity, where screen capture is enabled by policy), Idle Time (inactive time inside the duration), Title (the exact window or page title, e.g. 'Calendar Management | Scheduling Meeting - Outlook', 'Watching Tutorials | Python Beginners Tutorial - YouTube'), Description (the application or service, e.g. Outlook, YouTube, Visual Studio Code, WhatsApp) and a final idle flag column (Yes/No) marking whether the activity was flagged idle.
The three columns that make this page forensic: Computer pins the activity to a device; Screens says how much visual evidence backs this specific entry (and is the hook into Monitoring/Screenshots where policy allows); and Duration vs Idle Time plus the Yes/No idle flag together say how much of the entry was actually active. Rows marked 'Desktop Not Assigned' are users with no capturing device mapped - a coverage gap with no activity to show.
How it is used
This is a destination page, not a scanning page - you usually arrive here with a question. The routine: filter to the class of time you are investigating (for example Non-Productive), find the specific rows, and read each one in full - Computer, User, Title, Duration, Idle Time and the idle flag - before drawing any conclusion. A manager uses it to turn 'the category looked high' into 'here are the three actual activities and here is the context'. A CSM uses it to validate that classifications hold up at the row level and to demonstrate the investigate-with-context discipline to the customer.
The drill path: from a row with a Screens count, go to Monitoring (Screenshots) for the visual context where the customer's policy allows; for the aggregated 'where did time go' view that this page sits underneath, go back to Apps & Urls; for the input-intensity shape of the day, Intensity Graph.
How to read it right
This is the page where the surveillance guardrail is sharpest, because it is individual and granular. One: a single row is a signal, not a verdict. One Non-Productive entry - even a named messaging app - is not proof of misconduct; it is one activity on one device at one moment, and the honest move is to pull the surrounding context, not to act on the row. Two: Duration is not active time - read it with Idle Time and the Yes/No idle flag, because an activity can be flagged idle or mostly open-but-unworked. Three: the Productivity pill is a configurable classification, customer-set and illustrative in the demo. Four: Screens is an availability count, not a reason to look - the presence of screenshots does not justify viewing them outside the agreed policy and access scope. Five: 'Desktop Not Assigned' is a coverage gap, not evidence of inactivity. All rows here are seeded demo data for one fictional day.
How to demo and sell it
Demo this page carefully and deliberately - it is the deepest, most granular surface, so how you handle it is itself the sell to a trust-sensitive buyer. Show the log, point at the columns (Computer, User, Title, Duration, Idle, Screens) and say this is the evidence layer - the actual activities behind every number you have seen. Then lead with restraint, not with a 'gotcha': open one Non-Productive row and say this is one activity, on one device, at one moment - it is a prompt to understand with context, never a conclusion about a person, and viewing any screenshots behind it happens only inside the policy and access you set. That disciplined framing is exactly what separates governed evidence from spyware and is what lets a regulated RCM or BPO buyer say yes. Land one value point: when a real question arises, the manager has concrete, device-level evidence to investigate properly instead of acting on anecdote. Discovery question: when something looks off today, can your managers investigate with actual evidence and a defined access boundary - or do they act on a hunch?
Honest limits
Detailed Activity shows what application activity was captured on which device - it does not prove intent, does not prove the quality or output of the work, and a non-productive or idle-flagged row is never on its own a judgement about a person. Whether screen capture (the Screens column) and the depth of detail are available depends entirely on the customer's capture policy, agent mode, jurisdiction and plan, and access to this page and to screenshots must be scoped and the workforce informed - confirm all of this with product. The classification and idle thresholds are customer-configured. Treat every row here as seeded demo data and every investigation as something to do with context, not a verdict to read off the screen.
Interpretation check
A single Detailed Activity row - one activity, on one named Computer, by one User, even one classified Non-Productive or flagged idle - is a signal to investigate with context, never a verdict on a person; and Duration must always be read with Idle Time and the Yes/No idle flag, since an entry can be open-but-unworked.
In the field
For a regulated RCM buyer like KnackGlobal displacing an incumbent, the way a rep handles this page - evidence with restraint and a defined access boundary - is the differentiator. Demo the investigate-with-context discipline here, not a 'caught them' moment.
Practical task
On the demo Detailed Activity, filter to Non-Productive, pick one row and write a proper investigation note in four lines: the full row read (Computer, User, Title, Duration vs Idle Time and idle flag), what it does and does not tell you, what context you would gather next, and the sentence you would say to a manager who wants to act on the row alone.
Self-check
Which three columns make this page 'forensic', and what does each add?
Computer (ties the activity to a specific device, not just a person), Screens (how many screenshots back this entry, where policy allows) and Duration-with-Idle-Time-and-the-idle-flag (how much of the entry was actually active). Together they give device-level, evidence-backed, active-vs-idle detail.
A manager wants to act on one Non-Productive row showing a messaging app. What is your guidance?
Stop. One row is one activity on one device at one moment - a signal, not a verdict. Pull the surrounding context (the rest of the day, the idle flag, the title) and investigate with context before any conclusion about the person; the label is a configurable classification, not proof of misconduct.
What does the Screens column represent, and what does its presence NOT entitle you to do?
It is a count of screenshots attached to that activity where screen capture is enabled. Its presence does not entitle anyone to view them outside the agreed capture policy and access scope - it is an availability count, not a licence to look.
A row reads 'Desktop Not Assigned' with no activity. What does it mean?
That user has no capturing device mapped, so there is nothing captured to show. It is a coverage gap, not evidence they did no work.
Why read Duration together with Idle Time and the idle flag rather than alone?
Because Duration is how long the activity ran, not how long it was actively worked. An entry can be mostly idle or flagged idle (Yes), so only the three together tell you the honest active picture of that row.
Verified vs demo. The Detailed Activity columns (Productivity, Date, Computer, User, Duration, Screens, Idle Time, Title, Description, and a Yes/No idle flag) and the Productive/Non-Productive/Neutral filter were read from the live demo at /employeemonitoring/activity/detailedactivity; all rows are seeded demo data, the classification and idle thresholds are customer-configured, and whether screen capture and this depth of detail are available depends on the customer's capture policy, agent mode, access scope, jurisdiction and plan - confirm with product.