The Metadata Grid


The Metadata grid is the located on the right-hand side of the Session Viewer, and displays detailed information on monitored user activity in each session record.


The list of all activities recorded is displayed in the grid in the following columns:

• For Windows Clients:

- Activity Time: The time when the activity was recorded.

- Activity Title: The name of the active window that is associated with the recorded activity.

- Application Name: The name of the application opened on the Client computer.

- URL: The top and second-level domain name of the website visited.

- Text Data: The clipboard data.

- Alert/USB Rule: The name of the alert or USB rule triggered. The color of the alert highlighting corresponds to the risk level of the alert or the USB rule:

- Alerts with the Critical risk level are highlighted in red.

- Alerts with the High risk level are highlighted in yellow.

- Alerts with the Normal risk level are highlighted in blue.

• For macOS Clients:

- Activity Time: The time when the activity was recorded.

- Activity Title: The name of the active window that is associated with the recorded activity.

- Application Name: The name of the application opened on the Client computer.

- URL: The top and second-level domain name of the website visited.

- Alert: The name of the alert triggered. The color of an alert highlighting corresponds to the risk level of the alert:

- Alerts with the Critical risk level are highlighted in red.

- Alerts with the High risk level are highlighted in yellow.

- Alerts with the Normal risk level are highlighted in blue.

• For Linux Clients:

- Activity Time: The time when the command was executed.

- Command: The command executed.

- Function: The system call made.

- Parameters: The parameters of the executed command.

- Alert: The name of the alert triggered. The color of an alert highlighting corresponds to the risk level of the alert.

- Alerts with the Critical risk level are highlighted in red.

- Alerts with the High risk level are highlighted in yellow.

- Alerts with the Normal risk level are highlighted in blue.

NOTE: By default, the data is sorted by Activity Time, and the order and size of the columns can be modified.


To select and view the required record of user activity in the session (i.e. the records displayed in the Metadata grid, which is located on the right of the Session Player in the Session Viewer), as well as by simply clicking on it, the keyboard can also be used to navigate between the records:

• To navigate between all records in the session, press the Up Arrow (previous record) and Down Arrow (next record) keys.

• To navigate between the records in the session that containing alert events, press the Left Arrow (previous alert record) and Right Arrow (next alert record) keys.