> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# User Activity Recording Parameters
> Configure when and how Syteca records user activity on Client computers - Full-Motion Capture vs Interval Capture modes, event-triggered recording, frame rates, alert-only recording windows, and bit depth.
## Tune what gets recorded - and when - without leaving sessions un-monitored
User activity monitoring has a basic tension: capture enough fidelity that recordings are useful for incident review, but not so much that storage costs explode and Client computers slow down.
Syteca's user activity recording **gives you two recording modes plus event-triggered overlays** - so you can pick Full-Motion Capture continuous video for high-risk roles, Interval Capture screenshots for general monitoring, alert-only recording for low-risk endpoints where you only need forensics when something goes wrong. Same product, same agent, same Management Tool - the configuration is per Client or per Client group.
**Tune User Activity Recording when you need to:**
* **Reduce storage cost without losing forensic value** - switch general-workforce Clients to Interval Capture with event triggers (record on window switch, application start, keystroke) instead of Full-Motion Capture continuous video.
* **Get smooth playback for high-risk session review** - Full-Motion Capture at 4-30 fps produces smoother playback than interval screenshots, important when investigators need to follow rapid mouse/keyboard work.
* **Limit recording to actual incidents** - set "Record user activity only on alert or USB monitoring rule triggering" with a configurable pre-event and post-event window. Most sessions store only metadata; full recording kicks in only when something flags.
* **Mask sensitive UI elements** - combine with [Sensitive Data Masking](/docs/session-monitoring/recording/user-activity-recording#sensitive-data-masking-windows-only) (Windows Clients only) to prevent passwords, card numbers, and other PII from appearing in recordings.
**Applies to**: Windows Clients, macOS Clients, Linux Clients. The cross-platform parameters described below behave identically across platforms. **[Sensitive Data Masking](#sensitive-data-masking-windows-only)** is Windows-only.
## Where to find it
These parameters live on the **Editing Client** / **Editing Client Group** page, on the **User Activity Recording** tab, organized into three sections:
* **Activity Recording Configuration** - recording mode, event triggers
* **Recording Period Settings** - alert-only recording windows
* **Screen Capture Settings** - bit depth, active window only
## Activity Recording Configuration
### Recording Mode - Full-Motion Capture vs Interval Capture
The most consequential choice. Click either toggle button:
| Mode | What it does | When to use |
| ----------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **Full-Motion Capture** | Continuous video recording. Smoother playback than interval screenshots. | High-risk roles where rapid mouse/keyboard work matters; sessions where investigators need to follow exact UI navigation. |
| **Interval Capture** | Screen captures recorded at intervals and/or only when triggered. Significantly less data than video. | General-workforce monitoring, large Client populations, storage-constrained deployments. |
**After changing this toggle, new settings only take effect in a new Client session.** Existing sessions continue with their original recording mode until the user signs out and back in.
**Full-Motion Capture has feature limitations:**
* **[Live sessions](/docs/session-monitoring/player/overview#watch-a-session-in-real-time)**: Not currently supported.
* **Forensic Export**: Only partially supported - video can be exported (without metadata) to MP4 format, not the EFE format used by the [Syteca Forensic Player](/docs/session-monitoring/forensic-export).
* **Save Screen Capture**: The Tools menu option in the [Session Player](/docs/session-monitoring/player/overview) to download the current displayed screen capture is not supported.
* **[Sensitive Data Masking](#sensitive-data-masking-windows-only)**: Not supported.
Use Interval Capture if any of these features are required.
### Disable offline activity recording
If selected, the Client will **not** write monitoring data to its local cache (i.e. will not record any user activity) when there's no connection to the Application Server. By default this option is **off** - the Client caches locally and uploads when connectivity returns, ensuring no monitoring gaps.
### Record user activity periodically *(Interval Capture only)*
If selected, user activity is recorded at the **Period (sec)** frequency specified, regardless of whether anything changes on screen.
| Parameter | Range | Default |
| -------------- | ---------------- | ---------- |
| `Period (sec)` | minimum 1 second | 30 seconds |
**Not available** in Full-Motion Capture mode when recording video.
#### Stop recording after IDLE event
A sub-option of the above - if selected, screen captures stop recording after an idle event. Only relevant when "Record user activity periodically" is enabled. Pairs with the [idle detection parameters](/docs/session-monitoring/recording/idle-detection).
### Record user activity at a defined frame rate *(Full-Motion Capture only)*
If selected, user activity is recorded at the **Frame rate (fps)** specified, regardless of screen changes.
| Parameter | Range | Default |
| ------------------ | ------------------------------------- | ------- |
| `Frame rate (fps)` | 0.25 to 240 fps in 0.25-fps intervals | 4 fps |
**Only available** in Full-Motion Capture mode when recording video.
### Record user activity by event
Three independent checkboxes that trigger recording on specific user actions:
| Trigger | Records on |
| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Record user activity on active window switching** | New window opened (application launch, new browser tab, secondary window). Triggered even when window changes via keyboard shortcut. |
| **Check changing of window titles** | Title of the active window changes. Triggered even when title changes via keyboard. |
| **Record user activity on clicking and key pressing** | Each mouse click and each key press. Throttled: recorded data is sent **no more often than once every 3 seconds** to avoid impacting Client performance or database growth. |
In Full-Motion Capture mode, **these three event triggers only apply to metadata** - video recording itself is not affected.
## Recording Period Settings
### Record user activity only on alert or USB monitoring rule triggering
The most storage-efficient option. If selected, **user activity is recorded only when alerts or USB monitoring rules trigger**. Pre-event and post-event windows control how much context is captured.
| Parameter | Range | Default |
| ----------------------------- | ---------------------------------------------- | --------- |
| **Minutes before triggering** | 1 to 60 minutes | 4 minutes |
| **Minutes after triggering** | 1 to 60 minutes, or `0` = until end of session | 4 minutes |
Setting **Minutes after triggering** to `0` means "record from the trigger until the user signs out" - useful for high-severity alerts where you want full session capture from the moment a problem appears.
## Screen Capture Settings
### Enable screen capture recording along with user activity recording
If selected, screen captures or video are recorded. If deselected, only metadata (active window titles, URLs, text data) is recorded - no visual capture.
**Not available in SaaS** - SaaS deployments always capture screens when this section is configured to record.
After changing this option, new settings only take effect in a new Client session.
### Capture active window only
By default, screen captures cover the whole screen. If selected, **only the current active window** appears in screen captures or video - reducing both data volume and the chance of bystander content (notifications from other apps, etc.) appearing in recordings.
**For tight privacy controls** - pair "Capture active window only" with [Application Filtering parameters](/docs/session-monitoring/recording/filtering#application-filtering) to fully prevent sensitive applications from being recorded. The combination keeps recordings focused on what's relevant for security review without capturing personal email, banking sites, or similar private content visible elsewhere on the screen.
### Bit Depth
Screen captures and video default to **4-bit color depth (grayscale)** - the optimal balance between resolution clarity and storage footprint.
| Bit depth | Storage impact | Use case |
| ----------------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------- |
| **4-bit (grayscale)** | Smallest. Default. | Most monitoring scenarios. Sufficient for reading text, identifying applications, observing UI navigation. |
| **8-bit (256 colors)** | Moderate. | When color information matters (color-coded UIs, security console dashboards) but high fidelity isn't required. |
| **24-bit (true color)** | Largest. | Investigation playback of color-sensitive content - graphic design, video review, color-coded threat dashboards. |
**Not available in SaaS** - SaaS deployments use a fixed bit depth set by your Syteca vendor.
## Sensitive Data Masking *(Windows only)*
A separate feature configured on the **Privacy Settings** tab - but worth flagging here because it's central to the recording story.
**Sensitive Data Masking is available only for Windows Clients.** Not supported on macOS or Linux Clients, and not supported in [Full-Motion Capture](#recording-mode-full-motion-capture-vs-interval-capture) mode on Windows Clients.
Sensitive Data Masking applies **regex-based masking rules** to screen captures, clipboard activity, and keystrokes in real time. The canonical examples - Visa and Mastercard card numbers, US Social Security numbers, AWS access key IDs - get redacted from recordings before they're sent to the Application Server, so sensitive data never enters Syteca's database in cleartext.
Common rules: credit card numbers (Visa, Mastercard, Amex, Discover formats), Social Security numbers, AWS access keys, GitHub tokens, organization-specific account-number formats. See [Sensitive Data Masking](/docs/session-monitoring/masking/sensitive-data) for the configuration procedure.
## Related
Lifecycle management for the data this parameter generates.
Track Copy / Cut / Paste operations alongside screen capture.
Pause recording during idle periods to reduce data volume.
Track file upload operations on Client computers.