User activity monitoring (UAM) software

What is user activity monitoring?

User activity monitoring (UAM) is the practice of recording what users do on an organisation's computers and servers, then analysing it for security, compliance, investigation and productivity purposes. It differs from network monitoring, which watches traffic, and from log management, which collects system events: UAM looks at the person at the keyboard, so an action can be tied to a named user, a time, an application and, where you choose to record it, what was on screen.

UAM tools, also called employee activity monitoring software, typically answer questions like these:

• Who opened, copied, renamed or deleted a sensitive file, and where did it go next?
• Which external addresses received attachments from a departing employee's mailbox?
• Which privileged users ran commands on a server, and what did those commands do?
• Which applications and websites does a team rely on, and how much time do they take?
• What happened on screen in the minutes before and after an alert fired?

The same audit trail serves both security and operations, which is why UAM sits at the centre of most employee monitoring projects. It is also the part that needs the most care under UK data protection law, because a detailed activity log is personal data about every worker it covers. If you are new to the subject, what is employee monitoring? gives the wider picture.

What Teramind records

Teramind captures activity through an agent on each Windows, macOS or Linux computer and groups it into channels. You choose which channels are switched on, for whom and when. The table shows the main channels and the lowest Teramind plan that includes each one, from Teramind's own plan comparison.

Windows has the fullest coverage. On macOS some channels are limited or missing (for example instant messaging, online meetings and console commands), and on Linux geolocation and searches are not supported, so we check each requirement against the platforms you run before you commit. The Teramind agent page covers platform support in detail, and Teramind pricing and plans sets out what each plan includes.

Behaviour rules, alerts and automated responses

Recording on its own produces a lot of data. The value of UAM comes from behaviour rules, which watch the activity stream and act when something matches. Teramind groups rules into three kinds:

• Activity rules: match what a user does, such as opening an application, visiting a site, sending an email to a personal domain, copying files to a USB drive or printing outside working hours. Unlimited activity-based rules start on the UAM plan; Starter has a limited set.
• Schedule rules: match working patterns, such as arriving late, working on a day off, long idle periods or logging in outside set hours.
• Content-sharing rules: inspect what is being shared, in files, email, the clipboard, chat, keystrokes and AI tools, to spot sensitive data. These belong to the DLP plan; see Teramind DLP.

When a rule matches, Teramind can notify an administrator, warn the user with an on-screen message, block the action or redirect a browser on every plan. From the UAM plan it can also lock out the user, record video around the event, run a command or switch the user's active task. UAM also adds anomaly detection and dynamic risk scoring, regular-expression rules, out-of-the-box rule templates and full-text search across captured activity.

Warnings are often the most useful action. A short message explaining why uploading a client file to a personal cloud account is not allowed changes behaviour without anyone needing to investigate, and it makes the monitoring visible, which helps with the transparency the ICO expects. For the security side of rules, see insider threat detection software.

Dashboards, investigations and the audit trail

Teramind NextGen, the current interface, presents activity through preset dashboards including Overview, All Events, Applications & Websites, Behavior Alerts, Insider Threat Detection, Employee Monitoring and a Use Case Catalog of ready-made views for scenarios such as security forensics and compliance. An AI widget generator builds new dashboard widgets from plain-English requests.

For investigations, an alert links straight to the screen recording at that moment, so a reviewer sees the context rather than a line in a log. Recordings and still images can be exported as evidence for an HR process or an incident report.

Two features matter for accountability:

• Role-based access: you decide which administrators and managers can see which employees, departments and data types, so a line manager can see productivity summaries without access to screen recordings or email content.
• An audit log of administrators: Teramind's Audit dashboard records what dashboard users do, including viewing recordings, exporting data and turning monitoring on or off. Watching the watchers is part of good governance.

Teramind also integrates with SIEM platforms for security teams that want activity alongside other logs; at the time of writing that integration is configured through Teramind's Legacy interface while NextGen development continues.

Keeping UAM proportionate

UK law does not ban user activity monitoring, but it does require you to be clear about your purpose and to use the least intrusive means that will achieve it. The ICO's guidance, Employment practices and data protection: monitoring workers, warns against monitoring workers "just in case" and against function creep, where data gathered for one purpose drifts into another.

Teramind gives you the controls to set UAM up that way:

• Monitoring profiles: different channel settings for different employees, departments, computers or Active Directory groups, so finance or privileged IT staff can be monitored more closely than everyone else, if you can justify it.
• Schedules: record only during working hours.
• Scoping lists: monitor only listed applications and websites, or exclude personal banking, health and similar sites, which are then blacked out in recordings.
• Data minimisation options: live view without recording, or screen video kept only around rule violations.
• A visible agent: the Revealed agent shows staff that monitoring is running.

Deeper channels need more justification. Keystroke logging is on the ICO's list of high-risk processing that needs a data protection impact assessment, and email monitoring can pick up special category data, such as messages to a union representative or occupational health. Our page on employee monitoring DPIAs explains how the Teramind settings feed into one. This is general information, not legal advice; take legal advice for your situation.

How Forever Systems helps with UAM

We supply, set up and support Teramind, and we can help you get UAM working well from the start:

1. Define the questions: what you need UAM to answer, for which roles, and which channels that requires. Fewer channels for most people is usually the right starting point.
2. Pick the plan and hosting: Starter, UAM, DLP or Enterprise, in Teramind Cloud, your own private cloud or on-premises. See Teramind deployment options.
3. Choose the agent and roll it out: Teramind has Revealed, Standard and Stealth agents. The Stealth agent can be pushed silently through Group Policy, SCCM, Microsoft Intune or Jamf for Mac; Teramind documents the Standard agent as a local install so each user accepts its notice. See the Teramind agent.
4. Build profiles, rules and dashboards: matched to your DPIA and monitoring policy, with role-based access agreed up front.
5. Review and adjust: check that alerts are useful, remove channels you do not use and help keep agents on supported versions.

Ask us for a quote. Contact us with the number of users and what you want to achieve.