Unusual Activity Detection

Unusual Activity Detecting shows you deviations in employee activity measured in several metrics. These are measured in instances—an individual time period where unusual activity is found. See Unusual Activity in Monitoring > Unusual Activity.

• High activity

Unusually high activity is flagged when a member’s average activity stays above 95%

for at least 45 minutes. While short bursts of high activity can be normal during focused work, maintaining such intensity for longer periods is rare and may indicate artificial input.

• Consistent activity

Unusually consistent activity is flagged when a member’s average activity rate shows very little variation over time which can be a sign of scripted or artificial input. Unusually consistent activity is detected when:

• • The activity level fluctuates by 4% or less over a continuous 60-minute period, or
  • There is no fluctuation at all (0%) for 30 minutes or more

Note that while steady activity is expected during focused work, long periods of near-identical activity levels can be uncommon and may warrant review.

• Low keyboard input

Low keyboard input is flagged when a member uses the mouse consistently, but the keyboard activity remains at or near 0% for an extended period — suggesting unusually unbalanced input behavior.

Here is the detection logic behind:

• • For a continuous duration of 60 minutes or more
  • Keyboard activity is ≤ 2,
  • Mouse activity is 10+ in average per minute for this duration

• Low mouse input

Low mouse input is triggered when a member shows consistent keyboard activity but minimal or no mouse usage over an extended period. While some tasks (e.g., coding or writing) are keyboard-focused, a complete lack of mouse interaction may indicate unbalanced or scripted input.

• • For a continuous period of 60 minutes
  • Mouse activity is ≤ 2
  • Keyboard activity is 10+ in average per minute for this duration

• No breaks

No breaks is flagged when a member tracks time for more than 4 consecutive hours without recording any minute with activity level below 10%.

• Total instances

Total instances shows the cumulative number of unusual activity cases. Let's say a member has shown one instance in unusual activity in high activity and one instance in consistent activity, the total instances will be 2.

• Total time

Total time shows the duration of all instances combined together.