Tune what gets recorded - and when - without leaving sessions un-monitored
User activity monitoring has a basic tension: capture enough fidelity that recordings are useful for incident review, but not so much that storage costs explode and Client computers slow down. Syteca’s user activity recording gives you two recording modes plus event-triggered overlays - so you can pick Full-Motion Capture continuous video for high-risk roles, Interval Capture screenshots for general monitoring, alert-only recording for low-risk endpoints where you only need forensics when something goes wrong. Same product, same agent, same Management Tool - the configuration is per Client or per Client group.Tune User Activity Recording when you need to:
- Reduce storage cost without losing forensic value - switch general-workforce Clients to Interval Capture with event triggers (record on window switch, application start, keystroke) instead of Full-Motion Capture continuous video.
- Get smooth playback for high-risk session review - Full-Motion Capture at 4-30 fps produces smoother playback than interval screenshots, important when investigators need to follow rapid mouse/keyboard work.
- Limit recording to actual incidents - set “Record user activity only on alert or USB monitoring rule triggering” with a configurable pre-event and post-event window. Most sessions store only metadata; full recording kicks in only when something flags.
- Mask sensitive UI elements - combine with Sensitive Data Masking (Windows Clients only) to prevent passwords, card numbers, and other PII from appearing in recordings.
Applies to: Windows Clients, macOS Clients, Linux Clients. The cross-platform parameters described below behave identically across platforms. Sensitive Data Masking is Windows-only.
Where to find it
These parameters live on the Editing Client / Editing Client Group page, on the User Activity Recording tab, organized into three sections:- Activity Recording Configuration - recording mode, event triggers
- Recording Period Settings - alert-only recording windows
- Screen Capture Settings - bit depth, active window only
Activity Recording Configuration
Recording Mode - Full-Motion Capture vs Interval Capture
The most consequential choice. Click either toggle button:After changing this toggle, new settings only take effect in a new Client session. Existing sessions continue with their original recording mode until the user signs out and back in.
Disable offline activity recording
If selected, the Client will not write monitoring data to its local cache (i.e. will not record any user activity) when there’s no connection to the Application Server. By default this option is off - the Client caches locally and uploads when connectivity returns, ensuring no monitoring gaps.Record user activity periodically (Interval Capture only)
If selected, user activity is recorded at the Period (sec) frequency specified, regardless of whether anything changes on screen.Not available in Full-Motion Capture mode when recording video.
Stop recording after IDLE event
A sub-option of the above - if selected, screen captures stop recording after an idle event. Only relevant when “Record user activity periodically” is enabled. Pairs with the idle detection parameters.Record user activity at a defined frame rate (Full-Motion Capture only)
If selected, user activity is recorded at the Frame rate (fps) specified, regardless of screen changes.Only available in Full-Motion Capture mode when recording video.
Record user activity by event
Three independent checkboxes that trigger recording on specific user actions:In Full-Motion Capture mode, these three event triggers only apply to metadata - video recording itself is not affected.
Recording Period Settings
Record user activity only on alert or USB monitoring rule triggering
The most storage-efficient option. If selected, user activity is recorded only when alerts or USB monitoring rules trigger. Pre-event and post-event windows control how much context is captured.
Setting Minutes after triggering to
0 means “record from the trigger until the user signs out” - useful for high-severity alerts where you want full session capture from the moment a problem appears.
Screen Capture Settings
Enable screen capture recording along with user activity recording
If selected, screen captures or video are recorded. If deselected, only metadata (active window titles, URLs, text data) is recorded - no visual capture.After changing this option, new settings only take effect in a new Client session.
Capture active window only
By default, screen captures cover the whole screen. If selected, only the current active window appears in screen captures or video - reducing both data volume and the chance of bystander content (notifications from other apps, etc.) appearing in recordings.Bit Depth
Screen captures and video default to 4-bit color depth (grayscale) - the optimal balance between resolution clarity and storage footprint.Sensitive Data Masking (Windows only)
A separate feature configured on the Privacy Settings tab - but worth flagging here because it’s central to the recording story. Sensitive Data Masking applies regex-based masking rules to screen captures, clipboard activity, and keystrokes in real time. The canonical examples - Visa and Mastercard card numbers, US Social Security numbers, AWS access key IDs - get redacted from recordings before they’re sent to the Application Server, so sensitive data never enters Syteca’s database in cleartext. Common rules: credit card numbers (Visa, Mastercard, Amex, Discover formats), Social Security numbers, AWS access keys, GitHub tokens, organization-specific account-number formats. See Sensitive Data Masking for the configuration procedure.Related
Auto-cleanup
Lifecycle management for the data this parameter generates.
Clipboard monitoring
Track Copy / Cut / Paste operations alongside screen capture.
Idle detection
Pause recording during idle periods to reduce data volume.
File monitoring
Track file upload operations on Client computers.