User Activity Alarms

All reactions to user activities are triggered by alarms. As the ActivTrak Agent runs in the background, it’s looking out for a user's actions to match specific criteria configured by an account administrator. When these predefined conditions are met, the ActivTrak agent triggers a reaction on the user's machine or in the ActivTrak dashboard.

Three User Activity Alarm Categories:

User Activity

Made to fire off any user activity you define.

USB Tracking

Monitor USB ports for storage device activity and file transfers.


Monitor changes to your ActivTrak account.

A new ActivTrak account contains 8 pre-built alarms. However, you could create any number of alarms with any combination of conditions and reactions.

An alarm is made up of two parts. The first is an alarm's conditions or rules. This is the criteria that tells the ActivTrak agent to trigger a reaction. Configure an alarm to match any or all conditions you establish.

A condition begins with the field you want the agent to look for. Those include:

  1. Description
  2. Title bar
  3. Log on domain
  1. Primary domain
  2. Executable
  3. URL
  1. Duration (seconds)
  2. Private IP address
  3. Username

The rest of the condition involves an operator such as: greater than, does not contain, contains, starts with, ends with, equal to, and not equal to. Finally, the field and operator need a value such as a URL, titlebar, duration, or description to look for.

An example set of conditions looks like this: When URL contains YouTube, and duration is greater than 1200 (seconds). These alarm conditions will trigger a reaction when a user spends more than 20 minutes on YouTube.

The second part of an alarm is the Action. In our example above, the agent needs to be told what to do after a user spends more than 20 minutes on YouTube. Choose from a number of actions to execute when a user meets the predefined conditions.

User Activity Alarm Actions:

Screen Captures

Configure an alarm to capture images or videos of a user’s screen to see exactly what the device user sees. For still images, take a single screenshot or multiple screenshots at a minimum interval of 10 seconds. Take advantage of our Video Playback Add-on to record up to 30 seconds of video. Capture 15 seconds before and after the triggering event. View all screen captures with accompanying activity data in the ActivTrak app.

User Activity Notifications

An Alarm can send a custom notification to the desired recipient. Use a pop-up message to a user’s screen to re-route focus or congratulate them for their diligent work. Send an email to administrators or any other designated email address. Both pop-up messages and emails can be auto-populated with information from the triggered activity such as URL, executable, descriptions, device, and user.

Webhook notifications keep your systems in sync. Use a webhook to notify external systems of activities on tracked machines.

User Behavior Risk Scoring

User Risk Scores help you understand which users within your organization are behaving riskier than others. Assign a risk level to an alarm to indicate the severity of the conditions. As users trigger alarms, they begin to collect risk points. ActivTrak runs the numbers through an algorithm to come up with insightful scores to review in the application.


Terminate the application that has the potential for unwanted activity. Shut down an app upon access or after a specific time period. Use any of the available conditions to tell your agents when and for whom you want to close a program.

We Use Cookies!

We use cookies to provide you with a great user experience. By using our website, you agree to our Privacy Policy & Website Terms of Use .

request a demo