InfoWatch Activity Monitor is an employee activity monitoring solution designed for information security incident investigations and insider risk management. It operates on the organization's internal infrastructure and collects behavioral data from workstations to build a chronological picture of employee activity throughout the working day. The product collects the following data from workstations: - Login and logout registration - Keystroke/text input interception - Search engine query monitoring - Website visit tracking - Application usage monitoring - File and folder operation tracking (create, copy, delete, edit, transfer) - Activity categorization (working, non-working, or custom categories) - Screenshot capture on triggered events or at scheduled intervals - Real-time online monitoring InfoWatch Activity Monitor serves two primary use cases: incident investigation and productivity management. For incident investigations, it helps build an evidentiary base, monitor high-risk individuals, and detect unauthorized application or web service usage. For productivity management, it provides visibility into how working time is utilized across the organization, departments, and individual employees. The system is managed through a web console accessible remotely, and does not share collected data with third parties. Access to the monitoring data is governed by flexible access controls for security personnel. It integrates with InfoWatch Traffic Monitor (DLP) to enrich DLP event data with employee activity context.