User Activity Player
User Activity Player plays back a user's step-by-step activity showing clear user intent with an intuitive interface. It combines screenshots with valuable metadata, bringing user actions to flip book like playback.
User Activity Player focuses on a single user activity list shown in a chronological order aligned with the respective screenshots. This allows for investigating user behavior, one activity at a time.
Navigation controls provide a video-like showcase of the actions conducted by the user, and an activity summary panel expose additional information.
User Activity Player is currently available for endpoint only. Your entitlement must include Proofpoint ITM license.
Accessing User Activity Player
Activity Player can be accessed from the Alerts , Explorations and Timeline view in the Data Security Workbench application.
-
Navigate to the Alerts, Explorations or Timeline view.
-
Click to select the activity you want to investigate.
-
From the details area on the right-side, scroll down to the screenshot area.
-
Click the screenshot icon
( bottom left of the screenshot area) to open the Activity Player.
User Activity Player
User Activity Player includes:
User Activity List: Displays user activities in chronological order. The selected activity is highlighted to provide a comprehensive view of the user's behavior. You can turn on Activities with Enable External Screenshot Storages Only to view only the activities with screenshots or turn this option off to view all activities. As you click on an activity, the relevant screenshot displays. ( Located on the left-side.)
Screenshot View: Displays currently screenshot of the currently selected activity. (Located in the center.)
Activity Summary: Shows additional information for the selected activity. This automatically closes during screenshot auto-play and you can expand to see the information by clicking Show Details. (Located on the right-side, closed by default.)
Navigation Bar & Controls: Shows user activities over time. Activities that trigger an alert are shown by severity color - red (critical), orange (high), yellow (medium), gray (low). (Located at the bottom.)
Navigational controls include:
Start/Stop Auto-play: 
Initiate or pause screenshot auto-play from the selected activity in the activity list panel.
Next/Previous Activity: 
Navigate between user activities using the < or > icons.
User Activity Total Count: 
Shows both the number of the currently selected activity and the overall count, offering a comprehensive perspective on your investigation's scope. (Located bottom-right.)
Zoom: 
To zoom in/out, hover on the screenshot.
Batch: Move to the next/previous batch. A batch is 24 hours of activities.
To control the auto-play speed, click on the number next to the ‘Speed (sec)’ text located next to the activity count at the bottom-right side of the page. This option is hidden behind a feature toggle by default. To request this functionality please contact Proofpoint support. 
Related Topics: