> ## Documentation Index > Fetch the complete documentation index at: https://syteca.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Session Monitoring > Record, review, and investigate user activity across Windows, macOS, and Linux endpoints — screen captures, keystrokes, clipboard, file transfers, and full audit trails. ## Every action, recorded and reviewable Syteca's **User Activity Monitoring (UAM)** records what happens on an endpoint — not just that someone logged in, but every screen, keystroke, clipboard action, and file transfer along the way. It exists for the moment an incident, an audit, or a compliance request needs a real answer to "what actually happened here," not a guess reconstructed from scattered logs. This tab covers everything from configuring what gets recorded, to reviewing a session after the fact, to being proactively alerted the moment something looks wrong. **Use Session Monitoring when you need to:** * Investigate a specific incident — a data leak, a policy violation, a suspicious login — with a full visual and textual record. * Prove compliance (PCI DSS, HIPAA, SOC 2, ISO 27001) with an auditable trail of privileged and third-party activity. * Catch risky behavior as it happens, not weeks later, through real-time alerts and blocking. * Reduce the noise: filter, mask, and scope recording so you capture what matters without drowning in irrelevant data. **Pair it with [Privileged Access Management](/docs/pam/overview)** if the activity you're monitoring involves shared or privileged accounts — the two work together on the same recorded sessions. ## How it fits together Start in **Recording** — decide which activity types matter (screen captures, keystrokes, clipboard, file uploads, URLs), how much detail to capture, and how to filter out noise (by application, user, time window, or IP). Use the **Session Player** to watch recordings, search the **Metadata Grid** for specific text or events, and pull up **Reports & Dashboards** for aggregate views of productivity and risk. Configure **Alerts & Response** so specific behavior — a forbidden keyword, an off-hours login, a blocked USB device — triggers an immediate notification or automatic block, instead of waiting to be found during a manual review. **User Behavior Analysis** builds a behavioral baseline per user and flags sessions that deviate from it, surfacing the sessions worth a closer look without requiring you to watch everything. ## What's in this tab Configure what gets captured — screen activity, keystrokes, clipboard, files, URLs — and tune it with filters to cut noise. The Client Sessions list, the Session Player, forensic export, and archived sessions. Ad-hoc and scheduled reports, plus dashboards for at-a-glance user activity trends. Mask passwords, PII, and custom-defined patterns before they're ever stored. Behavioral baselines and anomaly detection, so you review what's actually unusual. Real-time notifications and automatic blocking when specific activity is detected. Monitor, restrict, or require approval for removable media. ## Related Secrets, session brokering, and password rotation for shared and privileged accounts. Where Clients, the Application Server, and the Management Tool fit together.