Viewing User Activity with the Monitoring Reports



The Monitoring Reports are deprecated and will be removed from the dashboard on February 28, 2021. Please use the new Business Intelligence (BI) Reports which offers more information, drill-down capabilities, enhanced export, and faster load time. Please contact support if you have any questions.


Help Topics


Introduction to the Monitoring Reports

Monitoring reports are individual activity reports for all the system objects (i.e. Websites, Apps, Network) tracked by Teramind. The data is usually displayed in a tabular format, but some reports may also have a trend graph near the top of the report. The reports can be viewed for a select date range. They can be searched; filtered by employees, departments or computers; exported as PDF/CSV files or scheduled to be delivered to email accounts at regular intervals. Each report screen also has its own setting you can use to configure if for your needs.

To change what and how Teramind monitors user activity, check out the Changing the Monitoring Settings section of the User Guide. 

Note that, not all reports are available in all Teramind offerings. The table below shows which reports are available on what product:


Accessing the Monitoring Report Menus

  1. To access a monitoring report, hover your mouse over the MONITORING menu, then
  2. Select a report from the sub-menu.

Performing Common Reporting Tasks

Setting a Data Range

  1. Each monitoring report screen has a dates-selector at the top-left corner. Click the dates-selector.
  2. Select a start date and an end date from the dates-selector window.
  3. Click the APPLY button.
  4. You can also select one of the pre-defined date-sets (i.e. Today, Yesterday, Last 7 Days etc.) from the left of the dates-selector window without having to select the start/end dates.
Good to know: If you set the date to current date (Today), the data on the report will refresh automatically every 5 minutes.


Sorting the Report Columns


Some of the report columns are sortable (i.e. Date/time, Employee etc.). Click on such a column’s title/header to toggle it’s sorting by Ascending or Descending order.

Searching in a Report

You can search for an item (i.e. activity, application name, website, document) in the monitoring reports. Note that, some reports (i.e. Screen Snapshots) do not have any Search option.

  1. Each report screen has a Search bar near the top-right corner. Type your text and click the Search button or press Enter.

Exporting Reports

You can export a monitoring report in PDF or CSV format. Note that, some reports (i.e. Screen Snapshots) do not have any export option.

  1. Click the PDF export mceclip2.png button or the CSV export mceclip3.png button near the Search bar at the top-right corner to export the report in those formats. You will see a message that the report is queued for export. Once the report is ready you will see a download message like below:


  1. Click the message to download the report.
You can later view and download all the exported reports from the System > Report export menu.

Changing the Report Settings

You can change which columns to Show/Export and the Daily Export settings for each monitoring report independently. Note that, some reports (i.e. Screen Snapshots) do not have any Settings/Export options.

  1. Click the Cog Wheel button to access the report’s settings window.
  1. Click the COLUMNS tab to change which columns are displayed (Active grid columns) and which of them are exported (Active export columns).
  1. Click the DAILY EXPORT tab to change which columns will be exported.
  2. You can also turn on the Enable Auto-Export feature for a scheduled delivery of the report.
  3. EXPORT PERIOD will let you define how long exported data will be. Daily reports will be sent every day with single day only. Weekly reports will contain last 7 days and sent on everyday basis too.
  4. You can specify the EXPORT DAYS (daily/weekly reports) or EXPORT DAY OF MONTH (monthly reports). Note that, for the daily/weekly reports, auto export will happen only on the selected days of the week (Sun-Sat). For the monthly reports, you can specify exact day when auto export should happen. For this type of report, it will contain data from same day (including) in previous month to export day (exclusive).
  5. You can select PDF or CSV from the EXPORT FORMAT.
  6. You can specify who will receive the reports in the EXPORT TO EMAIL(S) field. You can specify multiple email recipients.
You can later view and download all the exported reports from the System > Report export menu.

Using the Report Filters

Most of the monitoring reports have a set of common filters that let you narrow down the number of items displayed. You can filter by employees, departments, computers etc. Additionally, each report also has its own content-specific filters. For example, the Emailing Monitoring Report has filters for mail directions, email clients, presence of attachments etc.

  1. Report filters are usually located on the second row of the screen, at the top-right corner.
  1. Reports which have a graph/chart may also have additional filters. These are usually located on top of the chart, at the top-left corner. For example, the File Transfers Monitoring Report has filters for the chart to compare two different file activities.

Viewing Session Records

You can access a user’s desktop session live or view records of their past sessions.

  1. Wherever you see the Movie Camera icon, click it to access the Session Player. Usually, the icon is displayed on the Date/time column of a report or on a dashboard widget.
For more information about session recordings and playback check out the Session Player section.

Creating / Saving a Custom Report

You can create and save your own custom report. To do so, go to one of the Monitoring Reports. Configure the filters or settings the way you want it, then do the following:

  1. Click the Dot Menu near the top-right corner of the Dashboard. A pop-up menu will appear.
  2. Click the Save as button to save the report. The report will show up on the main MONITORING menu under Saved reports.

Deleting a Saved Report

  1. Click the MONITORING menu. A list of monitoring reports will appear.
  2. Scroll down until you see Saved reports. Under it, you will see all your saved reports. Click the small X button at the right side of a saved report to delete it.

Printing a Report

  1. Click the Dot Menu near the top-right corner of the Dashboard. A pop-up menu will appear.
  2. Click the Print button to print the report.

OCR (Optical Character Recognition)

Teramind’s advanced OCR feature allows you to discover onscreen text in real-time. The OCR engine continuously captures, indexes and analyses a user’s desktop using machine learning and sophisticated pattern recognition algorithms. With OCR, you can quickly search for textual information even inside images or videos, build powerful rules or conduct forensic investigation easily.


The OCR works with multi-monitor setups and virtual desktops, including the ones from the Terminal Servers.

Using the OCR Search Feature

To conduct an OCR search, do the following:

  1. Click the pull-down menu in-front of the search bar near the top-right corner of the screen (or at center of the screen if you are using the OCR report for the first time). Select a search type from the list. You can conduct four types of OCR search:
  • Fulltext: full text search with natural language processing (NLP).
  • Regexp: Regular expressions, e.g. [a-zA-Z]{4}[0-9]{12}.
  • Wildcard: Use ‘*’ as a wildcard, e.g. *doe will match John doe, jdoe, ddoe, etc.
  • Contains: Find any phrase that contains the text specified. Same as *term*.
  1. Enter your search criteria and press Enter or click the Search button.
  2. Optionally, you can use the second search box (Search apps/websites) to further narrow down the results.

Viewing the OCR Snapshots

OCR snapshots show a still picture of the screen where OCR located a search term. To access the snapshot, do the following:

  1. Click the Still Camera icon on the Date / time column to view the OCR snapshot for the searched item at a specific date and time. The OCR snapshot window will pop-up.
  1. On the OCR snapshot window, you will be able to see the user’s desktop with the areas highlighted in semi-transparent Yellow color where the OCR text were detected.

Web Pages & Applications

Web Pages & Applications report shows all the application processes run by the users and the web pages they have visited. In addition to the common report filters, you can view the report by individual website/app or aggregate the items by similar apps/websites.



Classifying Web Pages & Applications as Productive/Unproductive

We have enhanced the web pages & applications classification feature and moved it under the Configure > Productivity profiles menu. We have also moved all the productive, unproductive and unclassified time reporting from the monitoring reports to the BI Reports (e.g. Applications & Webpages and Productivity reports). These changes will give you more control and options for classifying employee productivity and reporting.

Aggregating Similar Items

  1. Click the AGGREGATE button near the top-right corner of the screen to turn it on or off. When aggregation is turned on, the report will aggregate similar web pages and apps together and the report columns will change to Process/URL, Duration, Agents (users) and Applications.

Showing Idle Time


  1. Click the SHOW IDLE TIME button to see idle times on the applications/websites.

Console Commands

Console Commands monitoring report tracks any console/terminal commands executed by a user or an application from the command line. The report shows: Date time, employee, computer, username, PID (program ID), the executed command and how long the program had been running.


Console Commands can be useful to keep an eye on privileged users (system admins, power users etc.) as these commands are often used to execute system-level applications and scripts. In the wrong hands, such commands can be dangerous and need overseeing.


The Email monitoring report tracks all emails being sent or received including information about the senders, recipients, email subject and body. The system can also save a copy of outgoing attachments (see the note below). All the email records are indexed so you can search for information related to the email actions, preventing security compromises and sensitive data from being transferred out of a system.


The report has a chart you can use to compare between the volumes of incoming and outgoing emails.

The software covers all email platforms, such as Outlook (web & desktop), Gmail, Yahoo, Yandex, and more.

Identifying the Email Origin

  1. The first icon on the Date/time column shows if it’s an incoming or outgoing mail.
  2. The second icon on the Date/time column shows what email client was used, for example Outlook, Gmail, Yahoo Mail etc.

Viewing / Saving / Printing Email Contents

  1. To view the email content, click the Envelope icon. A pop-up window will open.
  1. If there are any attachments (and you have enabled attachment captures on the Email Monitoring Settings) then, you can click on the attachment(s) to download them.
  2. You can save a copy of the email by clicking the SAVE AS PDF button or print it with the PRINT EMAIL button.

Saving Email Attachments

  1. If there are any attachments (and you have enabled attachment captures on the Email Monitoring Settings) then, you can click on an attachment to download from the Attachments column.  Note: you can also save an attachment from the email view window.

File Transfers

Use the File Transfers report to monitor all file transfer activity on the local drives, external drives (such as USB drives), network and even Cloud files. The report shows file action (access, write, upload/download etc.), the source (i.e. local disk, network), the full path of the file, file name, extension and what app initiated the file operation. File transfer monitoring helps prevent unauthorized access to sensitive files.


The report also has a chart you can use to compare between two file activities such as Upload vs. Download.


Note that Teramind cannot track the copy operation for a file from one network server to the same network server (e.g. source and destination is the same). For example, copying of a file from \\\source_folder to \\\destination_folder cannot be tracked. Copy to and from same local drives is detected as usual.

Also copying of an empty file cannot be tracked since it will be impossible for the system to distinguish between the file create and copy operations due to the zero size of the file.

Online Meetings

You can use the Online Meetings report to monitor online meeting activities for apps such as Zoom, AirCall, Microsoft Teams etc. The report shows employee/computer, when the meeting took place, duration, app, direction (incoming/outgoing) and participants. If you have enabled screen recording and/or audio recording from the monitoring settings, you will be able to view and/or hear the meetings by clicking the session player mceclip0.png icon.


The report also has a chart you can use to compare between two file activities such as Upload vs. Download.

Instant Messaging (IM)

Instant Messaging monitoring report helps you track any chat conversation, whether on the web or in-app. It can track  Google Hangout, Skype Web, Skype Desktop, Slack, Facebook Messenger etc. You can monitor incoming and outgoing messages and group chats.


The report shows the source, participants, no. of messages and the first line of the message. You can view a full copy of the conversation and export it as a PDF or CSV file.

Viewing / Saving the Message

  1. To view the messaging content or conversations, click the Envelope icon. A pop-up window will open:
  1. If more than one agent participated in the conversation, you can use the AGENT FILTER drop-down list to view a selected agent’s conversation only.
  2. Click the PDF/CSV download buttons to save the whole conversation as a PDF/CSV file.
  3. Click the LOAD OLD MESSAGES button to view older messages.

Social Media

Social Media monitoring report lets you track popular social media platforms such as Facebook, Twitter and LinkedIn. You can track new comments, edit comments, new posts and edit posts activities.


The report shows the source, action (post, comment etc.), name of any attachments being shared and the actual message.

Note that, you can only see the name of the files being shared on the Attachment columns. At the moment, you cannot download them.



Keystrokes monitoring report shows all the keystrokes enter by the users. In addition to regular keys, you can monitor the clipboard operations (copy/paste), use of special keys such as the Print Screen button,  hidden symbols (i.e. Space, Delete) etc. All the keys are captured, regardless of the user’s selected language.


Keylogging provides a wide range of insight into a user’s behavior. For example, you can detect if an employee is using unprofessional language with a customer; if someone is taking screenshots of an important document (with the likely intention of stealing information); a user repeating easy to guess passwords (hence, creating a security risk) etc.

Showing / Hiding Special Symbols

  1. Click the HIDE SYMBOLS button on the top right corner to show/hide symbols like the <Space>, <Control+C>, function keys etc.


Searches monitoring report lets you track what the users are searching for on sites like Google, Bing, YouTube etc.



The Printing monitoring report tracks all documents sent to the local or network printers. You can view or print a copy of the document or save it as a PDF file. The report shows the name of the document, printer, computer and user.


Monitoring employee print logs helps you reduce printing waste. It’s also prevents data leaks over hard copies.

Viewing / Saving / Printing Copies of the Document

  1. Click the document link under the Document column. A window will pop-up.
  1. From the pop-up window, you can print a selected page, all pages or save the document as a PDF file.

Screen Snapshots

The Screen Snapshots monitoring report allows you to have a quick glance over users’ desktops. You can choose multiple users or computers to view.

The snapshots are taken at 10-minute interval.

  1. By clicking a snapshot image, you can view a session recording of the user’s desktop. Check out the Session Player section for more information about session recordings and playback.
  2. Under each snapshot, you will see the Task the user’s working on and their activity level (in percentage). You can also quickly identify how a user is performing by taking a look at the color of this area:
  Green = 71% – 100% activity
  Yellow = 41% – 70% activity
  Orange = 21% – 40% activity
  Red = 0% – 20% activity



Sessions monitoring report shows an immutable log of all user sessions including: Time Started, Time Finished, Duration, Work Time, Employee, Computer (to which a remote user is connected to), Source Computer (from which a remote user connected from) and the IP. You can also view a trend graph for the sessions.


Network Monitoring

Network Monitoring report allows you to monitor network traffic from all applications and users connected to the internet, identify their locations, time and the exact IPs and ports used for the connections. Additionally, administrators can measure the amount of bandwidth used by employees and the specific computers used to establish the network connections.


The report shows detailed information for each network activity such as, the application processes/URLs, agents (users),  duration of a network session, amount of information sent or received, number of connections, ports and the protocols used (i.e. TCP, UDP, HTTPS).

Monitoring your company’s networks can give you insights into your network and detect potential signs of danger or abuse. For example, you can detect sudden spike in network usage indicating potential intrusion attempts. Or, you can discourage unproductive activities such as online shopping or social media browsing. Or, you can monitor video streaming sites to reduce unnecessary use of network traffic or bandwidth.

Aggregating Similar Items

  1. Click the AGGREGATE button near the top-right corner of the screen to turn it on or off. When aggregation is turned on, the report will group similar application processes/URLs together and the report columns will change to: Process/URL, Agents, Duration, In, Out and Connection count.

Showing / Hiding HTTPS Connections

  1. By default, HTTPS (SSL) connections aren’t shown on the report. To show/hide HTTPS connections, click the SHOW HTTPS button near the top-right corner of the screen.
  2. An extra column named ‘Hostname’ will be added to the table. The Dest. Port will also change to indicate if a connection is on HTTPS port.

Video Export

From this report screen you can view a list of all videos exported from the Session Player (check out the Downloading / Exporting Videos section to learn how to export the videos).


For each exported file, you can view information such as when the video was created, by whom and for which employee etc.

  1. You can enable the Persistent option to keep the file indefinitely. Otherwise, on Cloud deployments, it will be automatically deleted after 3 days.
  2. To download a file, click the Download mceclip1.png  icon in the Size column. This will open a new browser window:


  1. Right click anywhere on the window and select Save video as... option to save the file.
  2. You can also hover over the video and then click the small dot icon mceclip1.png at the bottom, select Download to save the file. 
Was this article helpful?
1 out of 1 found this helpful