Analyzing Screenshot Batches

A screenshot batch is a set of desktop images captured by the agent on a user’s computer, compressed into a package, and sent to the server.

Note

To analyze screenshot batches, make sure the Screenshot Batch setting is enabled in the configuration.

Screenshots allow you to:

• Continuously monitor and capture user activity through desktop images.

• Search for images linked to security events.

• Analyze user actions, making it easier to track task progress, detect violations, and assess performance.

Viewing Screenshot Batches

To view snapshot batches:

1. Go to the Constructor tab on the main page of the Staffcop web interface.

2. In the dimensions section on the left, click on Agent or Account to select the computer or user whose screenshots you want to view.

3. In Event Type, select Screenshot Batch.

4. In the top panel of the Constructor, set the time period you need to cover.

5. If needed, apply additional filters based on dimensions.

6. The list of screenshot batches for your selected time period will show up in the Event Lens.

7. Click on the event you’re interested in and use the player in the Content section to view the screenshots.

To start or stop playback, click on any part of the screenshot.

The screenshot batch player is compatible with the following browsers:

• Chrome

• Mozilla Firefox

• Opera

• Microsoft Edge

• Yandex Browser

The player’s control panel displays the batch size, total number of screenshots, and the timestamp for each screenshot.

When you hover over the progress bar, the time and sequence number of each screenshot will be shown. Click on the progress bar below the message to jump to a specific screenshot in the batch:

Use the control panel buttons to:

• Download the screenshot batch

• Jump to the first or last screenshot

• Rewind through the screenshots

• Adjust the playback speed

• Turn the full-screen mode on

Navigating to the Nearest Screenshot from an Event

Since version 5.5, you can navigate from an event to the closest screenshot to see what the user was doing at that moment.

To go from an event to the nearest screenshot in a batch:

1. Click the tools icon next to the event.

2. Select To the nearest screenshot pack.

The server launches the player for a batch when:

• The event’s local time falls within the batch’s local time range.

• The computer name and username linked to the event match those of the batch.

Warning

If an alert appears after clicking To the nearest screenshot pack, it means that full-time recording of screenshot batches was not active during the specified time for the user, and the server could not find any screenshots for this period. To resolve this, check the Interval between screenshots setting in Сonfiguration → Screenshot Batch (<../user_manual/configuration/screenshot pack>). The snapshot frequency might be too low, resulting in no recordings at the time of the event.

Full-Screen View

To view a batch of screenshots in full-screen mode:

• Press the F key on your keyboard.

• or click the expand button in the built-in player.

  

Keyboard Controls in Full-Screen Mode

In full-screen mode, you can use the following keyboard shortcuts for easier navigation:

Key	Action
Spacebar	Play or pause playback.
[ or ]	Adjust the playback speed.
, or .	Step backward or forward.
← or →	Step backward or forward.
↑ or ↓	Jump backward or forward 10 frames.
PgUp or PgDown	Jump backward or forward 50 frames.
Home or End	Move to the beginning or end of the batch.

You can exit full-screen mode using any of the following options:

• Press the F key

• Click the expand/collapse button on the control panel

• Press the Esc key

In the player’s full-screen mode, the following elements are displayed:

1. Computer Name and Username: Displays the user and computer associated with the screenshot.

2. Time Tracking: Shows detailed time information, including:

   • Website address, if the application is a browser

   • Window title

Note

If metadata is too long to display, it is truncated. Hover over the truncated string for more than two seconds to view the full address.

3. Event Table: Opens by clicking the event table icon.

4. Activity Table: Opens by clicking the activity table icon.

5. Screenshot Batch Player: Allows you to play and navigate through captured screenshots.

Note

The message “No data in Activity Data” indicates that the screenshot in the batch is not associated with the Activity Time event or a user is not specified.

View Events and User Activity

To review user activities and events:

1. Click the Event Table or Activity Table icons in the upper-right corner.

2. During playback, records matching the local time of the current snapshot are highlighted.

3. Double-click an entry in either table to switch the player to display it.

4. Use the hide table icon to hide the table when needed.

Activity Table

The Activity Table allows you to see all user activity that falls within the time range of screenshot batches.

Includes Local Time, Application Name, and Window Title.

Event Table

The Event Table allows you to see user events that fall within the time range of a screenshot batch.

Includes Local Time of the event, Event Type, and Triggered Policy.

Not available for the following event types:

• Screenshot

• Screenshot Batch

• Desktop Video

• User Activity

• Installation

• Devices Inventory

• Metric

• System Log

Search for Events and Activities

In the Event and Activity tables, you can search for events withing a table: enter up to 100 characters in the search bar and press Enter.

To reset the search results and return to the original list, click on the cross icon.

Viewing SCRPACK Files of Screenshot Batches

When you download a screenshot batch, it is saved in the SCRPACK format, which cannot be viewed using standard image viewing applications.

You can open the screenshot batch’s scrpack file:

• In the Staffcop web interface

• With the Offline Screenshot Batch Player

The offline player offers the same functionality as the standard screenshot batch player, with the added ability to view event and activity tables.

Viewing in the web interface

To view the scrpack-file in the web interface:

1. Go to Admin → Viewing file “Image Package”.

2. On the top, click the Select File button and open scrpack-file you need.

Viewing in an offline player

To view scrpack-files, install the offline player on your computer.

Installing on Windows

1. Go to Control Panel → Computers.

2. In the Download Agent section, select Screenshots Pack Player — Windows and confirm the download.

3. Run the .exe file.

Note

If you see a system warning “Windows has protected your computer,” click More info → Run anyway.

4. Once installation is complete, open the scrpack-player application.

5. In the pop-up window, click Select File… and open the downloaded scrpack-file.

Installing on Linux

1. Go to Control Panel → Computers.

2. In the Download Agent section, select Screenshots Pack Player — Linux and confirm the download.

3. Run the .deb package.

4. After installation is complete, open the scrpack-player application.

5. In the pop-up window, click Select File… and open the downloaded scrpack-file.