DEPRECATED FEATURE
The Monitoring Reports are deprecated. Please use the new BI Reports which offers more information, drill-down capabilities, enhanced export, and faster load time. Please contact Teramind support if you have any questions.
Introduction to the Monitoring Reports
Monitoring reports are individual activity reports for all the system objects (i.e. Websites, Apps, Network) tracked by Teramind.
The data is usually displayed in a tabular format, but some reports may also have a trend graph near the top of the report. The reports can be viewed for a select date range. They can be searched; filtered by employees, departments or computers; exported as PDF/CSV files or scheduled to be delivered to email accounts at regular intervals. Each report screen also has its own setting you can use to configure it for your needs.
To change what and how Teramind monitors user activity, check out the Monitoring Settings section of the User Guide.
Note that, not all reports are available in all Teramind offerings. The table below shows which reports are available on what product:
Monitoring Report | Starter | UAM | DLP | Enterprise |
|
|
| ✔ | |
✔ | ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
✔ | ✔ | ✔ | ✔ | |
✔ | ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
✔ | ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
✔ | ✔ | ✔ | ✔ | |
✔ | ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ | |
| ✔ | ✔ | ✔ |
Accessing the Monitoring Menus
1. To access a monitoring report, hover your mouse over the MONITORING menu, then
2. Select a report from the sub-menu:
Performing Common Reporting Tasks
Selecting a Data Range
1. Each monitoring report screen has a dates-selector at the top-left corner. Click the dates-selector.
2. Select a start date and an end date from the dates-selector window.
3. Click the APPLY button.
4. You can also select one of the pre-defined date-sets (i.e. Today, Yesterday, Last 7 Days, etc.) from the left of the dates-selector window without having to select the start/end dates.
Good to know: If you set the date to current date (Today), the data on the report will refresh automatically every 5 minutes.
Sorting the Report Columns
Some of the report columns are sortable (i.e. Date/time, Employee, etc.). Click on such a column’s title/header to toggle its sorting by Ascending or Descending order.
Searching in a Report
You can search for an item (i.e. activity, application name, website, document) in the monitoring reports. Note that, some reports (i.e. Screen Snapshots) do not have any Search option.
1. Each report screen has a Search bar near the top-right corner. Type your text and click the Search button or press Enter.
Exporting Reports
Manual Export / Download
You can export a monitoring report in PDF or CSV format. Note that, some reports (i.e. Screen Snapshots) do not have any export option.
If you do not see the PDF/CSV export buttons, and you are a department manager, this means the DISALLOW MANAGERS TO SEE AND EXECUTE EXPORTS option is enabled under Settings > Security > Access to exported data. Please contact your admin to turn it on.
1. Click the PDF export button or the CSV export button near the Search bar at the top-right corner to export the report in those formats. You will see a message that the report is queued for export. Once the report is ready you will see a download message like below:
2. Click the message to download the report.
You can later view and download all the exported reports from the System > Report export menu.
Daily Export (Auto Export / Scheduled Export)
You can schedule the report to get delivered daily to selected email addresses from the Report Settings window. See below to learn how.
Changing the Report Settings
You can change which columns to Show/Export and the Daily Export settings for each monitoring report independently. Note that, some reports (i.e. Screen Snapshots) do not have any Settings/Export options.
1. Click the Cog Wheel button to access the report’s settings window.
2. Click the COLUMNS tab to change which columns are displayed (Active grid columns) and which of them are exported (Active export columns).
3. Click the DAILY EXPORT tab to change which columns will be exported.
4. You can also turn on the Enable Auto-Export feature for a scheduled delivery of the report.
5. EXPORT PERIOD will let you define how long exported data will be for. Daily reports will be sent every day with data for a single day only. Weekly reports will contain the last 7 days and sent on an everyday basis too.
6. You can specify the EXPORT DAYS (daily/weekly reports) or EXPORT DAY OF MONTH (monthly reports). Note that, for the daily/weekly reports, the auto export will happen only on the selected days of the week (Sun-Sat). For the monthly reports, you can specify exact day when auto export should happen. For this type of report, it will contain data from the same day (including) in previous month to export day (exclusive).
7. You can select PDF or CSV from the EXPORT FORMAT.
8. You can specify who will receive the reports in the EXPORT TO EMAIL(S) field. You can specify multiple email recipients.
You can later view and download all the exported reports from the System > Report export menu.
Using the Report Filters
Most of the monitoring reports have a set of common filters that let you narrow down the number of items displayed. You can filter by employees, departments, computers, etc. Additionally, each report also has its own content-specific filters. For example, the Emailing Monitoring Report has filters for mail directions, email clients, presence of attachments, etc.
1. Report filters are usually located on the second row of the screen, at the top-right corner.
2. Reports which have a graph/chart may also have additional filters. These are usually located on top of the chart, at the top-left corner. For example, the File Transfers Monitoring Report has filters for the chart to compare two different file activities.
Viewing Session Records
You can access a user’s desktop session live or view records of their past sessions.
1. Wherever you see the Movie Camera icon, click it to access the Session Player. Usually, the icon is displayed on the Date/time column of a report or on a dashboard widget.
For more information about session recordings and playback check out the Session Player section.
Creating / Saving a Custom Report
You can create and save your own custom report. To do so, go to one of the Monitoring Reports. Configure the filters or settings the way you want it, then do the following:
1. Click the Dot Menu near the top-right corner of the Dashboard. A pop-up menu will appear.
2. Click the Save as button to save the report. The report will show up on the main MONITORING menu under Saved reports.
Converting a Saved Monitoring Report to a BI Custom Report
1. Open your custom/saved Monitoring Report. Click the CONVERT TO BI button at the top. This will create a custom BI Report with widgets that show the same data as your Monitoring Report. Any filters you applied to your Monitoring Report will be preserved on the BI Report. See the Custom BI Reports section for more information.
Note that, at the moment not all of your saved monitoring reports can be converted. Only Monitoring Reports which have equivalent BI Report types can be converted.
Deleting a Saved Report
1. Click the MONITORING menu. A list of monitoring reports will appear.
2. Scroll down until you see Saved reports. Under it, you will see all your saved reports. Click the small X button at the right side of a saved report to delete it.
Printing a Report
1. Click the Dot Menu near the top-right corner of the Dashboard. A pop-up menu will appear.
2. Click the Print button to print the report.
OCR (Optical Character Recognition)
Teramind’s advanced OCR feature allows you to discover on-screen text from the screen recordings. The OCR engine continuously captures, indexes, and analyses a user’s screen recordings using machine learning and sophisticated pattern recognition algorithms. With OCR, you can quickly search for textual information even inside images or videos, build powerful rules, or conduct forensic investigation easily.
The OCR works with multi-monitor setups and virtual desktops, including the ones from the Terminal Servers.
Using the OCR Search Feature
To conduct an OCR search, do the following:
1. Click the pull-down menu in-front of the search bar near the top-right corner of the screen (or at center of the screen if you are using the OCR report for the first time). Select a search type from the list. You can conduct four types of OCR searches:
Fulltext: full text search with natural language processing (NLP).
*Regexp: Regular expressions, e.g. [a-zA-Z]{4}[0-9]{12}.
Wildcard: Use ‘*’ as a wildcard, e.g. *doe will match John doe, jdoe, ddoe, etc.
Contains: Find any phrase that contains the text specified. Same as *term*.
2. Enter your search criteria and press Enter or click the Search button.
3. Optionally, you can use the second search box (Search apps/websites) to further narrow down the results.
*When using the Regexp search feature, please remember that Teramind supports the Elasticsearch regular expression syntax for the search. More information can be found about it in Elastic documentation.
Viewing the OCR Snapshots
OCR snapshots show a still picture of the screen where OCR located a search term. To access the snapshot, do the following:
1. Click the Still Camera icon on the Date / time column to view the OCR snapshot for the searched item at a specific date and time. The OCR snapshot window will pop-up.
2. On the OCR snapshot window, you will be able to see the user’s desktop with the areas highlighted in semi-transparent Yellow color where the OCR text was detected.
Web Pages & Applications
The Web Pages & Applications report shows all the application processes run by the users and the web pages they have visited. In addition to the common report filters, you can view the report by individual website/app or aggregate the items by similar apps/websites.
Classifying Web Pages & Applications as Productive/Unproductive
We have enhanced the web pages & applications classification feature and moved it under the Configure > Productivity Profiles menu. We have also moved all the productive, unproductive and unclassified time reporting from the monitoring reports to the BI Reports (e.g. Applications & Websites and Productivity reports). These changes will give you more control and options for classifying employee productivity and reporting.
Aggregating Similar Items
1. Click the AGGREGATE button near the top-right corner of the screen to turn it on or off. When aggregation is turned on, the report will aggregate similar web pages and apps together and the report columns will change to Process/URL, Duration, Agents (users) and Applications.
Showing Idle Time
1. Click the SHOW IDLE TIME button to see idle times on the applications/websites.
Console Commands
The Console Commands monitoring report tracks any console/terminal commands executed by a user or an application from the command line. The report shows: Date time, employee, computer, username, PID (program ID), the executed command and how long the program had been running.
Console Commands can be useful to keep an eye on privileged users (system admins, power users, etc.) as these commands are often used to execute system-level applications and scripts. In the wrong hands, such commands can be dangerous and need oversight.
Emailing
The Email monitoring report tracks all emails being sent or received including information about the senders, recipients, email subject, and body. The system can also save a copy of outgoing attachments (see the note below). All the email records are indexed so you can search for information related to the email actions, preventing security compromises and sensitive data from being transferred out of a system.
The report has a chart you can use to compare between the volumes of incoming and outgoing emails.
The software covers all email platforms, such as Outlook (web & desktop), Gmail, Yahoo, Yandex, and more.
Identifying the Email Origin
1. The first icon on the Date/time column shows if it’s an incoming or outgoing mail.
2. The second icon on the Date/time column shows what email client was used, for example Outlook, Gmail, Yahoo Mail, etc.
Viewing / Saving / Printing Email Contents
1. To view the email content, click the Envelope icon. A pop-up window will open.
2. If there are any attachments (and you have enabled attachment captures on the Email Monitoring Settings) then, you can click on the attachment(s) to download them.
3. You can save a copy of the email by clicking the SAVE AS PDF button or print it with the PRINT EMAIL button.
Saving Email Attachments
1. If there are any attachments (and you have enabled attachment captures on the Email Monitoring Settings) then, you can click on an attachment to download from the Attachments column. Note: you can also save an attachment from the email view window (See the Viewing / Saving / Printing Email Contents section above).
File Transfers
Use the File Transfers report to monitor all file transfer activity on the local drives, external drives (such as USB drives), network, and even Cloud files. The report shows file action (access, write, upload/download, etc.), the source (i.e. local disk, network), the full path of the file, file name, extension, and what application initiated the file operation. File transfer monitoring helps prevent unauthorized access to sensitive files.
The report also has a chart you can use to compare between two file activities such as Upload vs. Download.
Note that Teramind cannot track the copy operation for a file from one network server to the same network server (e.g. source and destination is the same). For example, copying of a file from \\103.247.55.101\source_folder
to \\103.247.55.101\destination_folder
cannot be tracked. Copying to and from the same local drives is detected as usual, provided local file tracking is enabled in the File Transfers monitoring settings.
Also copying of an empty file cannot be tracked since it will be impossible for the system to distinguish between the file create and copy operations due to the zero size of the file.
Online Meetings
You can use the Online Meetings report to monitor online meeting activities for apps such as Zoom, Webex, AirCall, Microsoft Teams, BlueJeans, 8x8, RingCentral, etc. The report shows employee/computer, when the meeting took place, duration, app, direction (incoming/outgoing), and participants. If you have enabled screen recording and/or audio recording from the monitoring settings screen, you will be able to view and/or hear the meetings by clicking the Camera icon.
Sometimes, apps like MS Teams, Zoom, etc. wouldn’t include participant details (e.g., name, email, etc.) for some online meetings. For example, when a user attempts to join an ongoing Teams meeting, only the current user is added to the participant list. Participants who are already in the meeting are not included. For these participants, the Agent cannot track the usernames. These users will be shown as +1, +2, etc. in the Participants column:
Note that the Duration column will continue to track time even if the meeting app window isn’t active. It will only stop tracking once the meeting is ended.
Instant Messaging (IM)
The Instant Messaging monitoring report helps you track any chat conversation, whether on the web or in-app. It can track Google Chat, Skype Web, Skype Desktop, Slack, etc. You can monitor incoming and outgoing messages and group chats.
The report shows the source, participants, number of messages, and the first line of the message. You can view a full copy of the conversation and export it as a PDF or CSV file.
Viewing / Saving the Message
1. To view the messaging content or conversations, click the Envelope icon. A pop-up window will open:
2. If more than one agent participated in the conversation, you can use the AGENT FILTER drop-down list to view a selected agent’s conversation only.
3. Click the PDF/CSV download buttons to save the whole conversation as a PDF/CSV file.
4. Click the LOAD OLD MESSAGES button to view older messages.
Social Media
The Social Media monitoring report lets you track popular social media platforms such as Facebook, Twitter, and LinkedIn. You can track new comments, edit comments, new posts, and edit posts activities.
The report shows the source, action (post, comment etc.), name of any attachments being shared and the actual message.
Note that, you can only see the name of the files being shared on the Attachment columns. At the moment, you cannot download them.
Keystrokes
The Keystrokes monitoring report shows all the keystrokes entered by the users. In addition to regular keys, you can monitor the clipboard operations (copy/paste), use of special keys such as the Print Screen button, hidden symbols (i.e. Space, Delete), etc. All the keys are captured, regardless of the user’s selected language.
Keylogging provides a wide range of insight into a user’s behavior. For example, you can detect if an employee is using unprofessional language with a customer; if someone is taking screenshots of an important document (with the likely intention of stealing information); a user repeating easy to guess passwords (hence, creating a security risk), etc.
Showing / Hiding Special Symbols
1. Click the HIDE SYMBOLS button on the top right corner to show/hide symbols like the <Space>, <Control+C>, function keys, etc.
Searches
The Searches monitoring report lets you track what the users are searching for on sites like Google, Bing, YouTube, ChatGPT, etc.
*Since Windows Agent 17.0, support for ChatGPT searches/conversations has been added on Windows. However, currently only the user's inputs are captured on the Search report; ChatGPT responses aren't captured.
Printing
The Printing monitoring report tracks all documents sent to the local or network printers. You can view or print a copy of the document or save it as a PDF file. The report shows the name of the document, printer, computer, and user.
Monitoring employee print logs helps you reduce printing waste. It’s also prevents data leaks over hard copies.
Viewing / Saving / Printing Copies of the Document
1. Click the document link under the Document column. A window will pop-up.
2. From the pop-up window, you can print a selected page, all pages, or save the document as a PDF file.
Screen Snapshots
The Screen Snapshots monitoring report allows you to have a quick glance over users’ desktops. You can choose multiple users or computers to view.
The snapshots are taken at 10-minute interval, and this interval is not customizable.
1. By clicking a snapshot image, you can view a session recording of the user’s desktop. Check out the Session Player section for more information about session recordings and playback.
2. Under each snapshot, you will see the Task the user is working on and their activity level (in percentage). You can also quickly identify how a user is performing by taking a look at the color of this area:
Explanation of Previews/Thumbnails
Timeslots may show different types of previews/thumbnails depending on the task/time or screen recording availability:
| Video Thumbnail with task and activity percentage Normal timeslot. You can view the screen recording and time record for this timeslot. |
| Empty thumbnail with timestamp It can happen due to one of these reasons:
|
| Video Thumbnail with a "No task" message It means you deleted the time/task using the Remove time and keep screen records option. |
| Video Thumbnail with a "No task (restricted)" message It means you deleted the time/task using the Remove time and restrict access for screens option. |
| Thumbnail shows a "Manual time" message It means you either manually added time or the user used the web-based Tracker to clock-in. |
| Thumbnail shows a "No preview available" message This can happen due to one of the following reasons:
|
| Thumbnail shows a "No record" message This can happen due to one of the following reasons:
|
| Thumbnail shows a "SESSION LOCKED" message This is usually seen when a computer is locked/went to sleep with an older version of the Agent. Sometimes, antivirus software can also cause this. |
Empty/Black thumbnail It means one of the Suspend Monitoring options is enabled and it blacked out the app/website from the screen recording. For more information, see the Applications and Websites monitoring settings. | |
|
Thumbnail shows just an image icon This icon will be seen in cloud hosted dashboards for recordings older than 180 days that have been deleted. Please refer to our Retention Policy article for further details |
Manually Adding Time
There are two ways you can add time from the Snapshots list.
Adding Time Using the ADD TIME Button
1. You can quickly add time to an empty slot by hovering over it and clicking the + ADD TIME button. A pop-up window will appear:
2. Select a user (you need to select a user if you are viewing the screenshots for a computer that has multiple users).
3. Select a task.
4. Drag the two sliders to set the start and end times.
5. Click the ADD TIME button to add the time.
Adding Time Using the ADD/REMOVE TIME Button
1. Click the ADD/REMOVE TIME button located near the top-right corner of the report. A pop-up window will appear:
2. Select a user (you need to select a user if you are viewing the screenshots for a computer that has multiple users).
3. Select a task.
4. Drag the two sliders to set the start and end times.
Deleting/Restoring Time and Screen Recordings
There are two ways you can remove time and/or screen recordings from the Snapshots list.
You can also add/edit/remove time from the Time Records and the Time Cards report.
Deleting time will only remove the records from the various Time Tracking reports such as the Time Records and Time Cards reports. It will not remove the user activities/logs from the Monitoring and BI reports. However, deleting the screen records will remove them permanently.
Deleting/Restoring Time Using the X Button
1. You can quickly delete time/screen records by hovering over a time slot and clicking the X button. Depending on the time slot, you might see one of the 4 pop-up windows:
| These options will be shown if the slot you selected has a time/task record and video recording:
1. Remove time and keep screen records: will remove the time/task record but will keep the screen recording.
2. Remove time and restrict access for screens: will remove the time and task record and make the screen recording accessible to users who have the Play restricted historic screen stream access permission. Users without this permission will not be able to view the screen recording.
3. Remove time and keep screen records: will remove both the time/task and screen recording. |
| These options will be shown if the slot you selected has a video recording but no task (e.g., you removed the task by choosing option 1 from the above dialogue):
1. Restrict access for screens: will remove the time and task record and make the screen recording accessible to users who have the Play restricted historic screen stream access permission. Users without this permission will not be able to view the screen recording.
2. Remove screen records: will remove the screen recording. |
| These options will be shown if the slot you selected has a restricted video recording (e.g., you removed the task by choosing option 1 from the above dialogue):
1. Restore screen records access: will restore the screen recording so that it's playable by a regular user.
2. Remove screen records: will remove the screen recording. |
| This option will be shown if the slot you selected was manually added (see the Manually Adding Time section above). |
Deleting Time Using the ADD/REMOVE TIME Button
1. Click the ADD/REMOVE TIME button located near the top-right corner of the report. A pop-up window will appear:
2. Drag the two sliders to set the start and end times.
3. Click the REMOVE TIME button. You will see a pop-up window:
4. Select from one of the options:
Remove time and keep screen records: will remove the time/task record but will keep the screen recording.
Remove time and restrict access for screens: will remove the time and task record and make the screen recording accessible to users who have the Play restricted historic screen stream access permission. Users without this permission will not be able to view the screen recording.
Remove time and keep screen records: will remove both the time/task and screen recording.
You can configure the default option for the above delete pop-up window from the DEFAULT ACTION FOR SCREEN RECORDS DELETION setting located under the Settings > Agent Defaults screen.
Sessions
The Sessions monitoring report shows an immutable log of all user sessions including: Time Started, Time Finished, Duration, Work Time, Employee, Computer (to which a remote user is connected to), Source Computer (from which a remote user connected from), and the IP. You can also view a trend graph for the sessions.
Network Monitoring
On Cloud deployments, this report is available on request. Please contact your customer service representative to enable it on your instance.
The Network Monitoring report allows you to monitor network traffic from all applications and users connected to the internet, identify their locations, time and the exact IPs and ports used for the connections. Additionally, administrators can measure the amount of bandwidth used by employees and the specific computers used to establish the network connections.
The report shows detailed information for each network activity such as, the application processes/URLs, agents (users), duration of a network session, amount of information sent or received, number of connections, ports, and the protocols used (i.e. TCP, UDP, HTTPS).
Monitoring your company’s networks can give you insights into your network and detect potential signs of danger or abuse. For example, you can detect sudden spikes in network usage indicating potential intrusion attempts. Or, you can discourage unproductive activities such as online shopping or social media browsing. Or, you can monitor video streaming sites to reduce unnecessary use of network traffic or bandwidth.
Aggregating Similar Items
1. Click the AGGREGATE button near the top-right corner of the screen to turn it on or off. When aggregation is turned on, the report will group similar application processes/URLs together and the report columns will change to: Process/URL, Agents, Duration, In, Out, and Connection count.
Showing / Hiding HTTPS Connections
1. By default, HTTPS (SSL) connections aren’t shown on the report. To show/hide HTTPS connections, click the SHOW HTTPS button near the top-right corner of the screen.
2. An extra column named ‘Hostname’ will be added to the table. The Dest. Port will also change to indicate if a connection is on an HTTPS port.
Camera Usage
The Camera Usage report allows you to view detailed information about the camera (e.g., webcam) usage statistics by the users. It displays information such as: Employee, Computer, Duration, Time Started (when the camera was activated/started), Time Finished (when the camera was deactivated/stopped), Name (name of the camera/webcam), and Application (in which app the camera was used):
Note that the Camera Usage report doesn't capture the video/audio directly. It just provides a way for you to track when the camera is being used, by whom, and in what apps. You can, however, view the user's screen and listen to the audio on the Session Player if the Screen and Audio recording is turned on.