The Unusual Activity Report: A Quick Guide


Note: The Unusual Activity Report is only available for customers with Premium Subscription and only to Managers, Admins, and Owners.

The Unusual Activity Report: A Quick Guide


The Unusual Activity Report analyzes user keyboard and mouse activity patterns and highlights instances of unusual behavior that may indicate potential discrepancies in time tracking. By providing meaningful insights, this report aids in reinforcing transparency, accountability, and trust within your team.

How Does It Work?

The report analyzes three types of activity: mouse clicks, mouse movements, and keyboard strokes for each second  tracked by Time Doctor. The activity is aggregated by calendar 30-minute periods. If suspicious activity is shorter than 30 consecutive minutes, it will not be shown on the report.

Identifying Unusual Behavior

The report is designed to flag several types of unusual behavior, including:

  • Unusually high keystrokes: This feature identifies excessive typing activity that may be out of the ordinary.
  • Mouse moves without clicks: The report flags prolonged periods of mouse movement without any associated clicking.
  • Unusually high mouse clicks: This detects an unusually high amount of mouse clicks.
  • Inconsistent mouse moves or keyboard strokes: The system identifies patterns of unusually consistent mouse movements or keyboard strokes, which may indicate automated activity.
  • Long keyboard activity with no mouse: The report highlights extended periods of keyboard activity without any mouse interaction, which may be unusual for certain types of work.

The report also allows you to filter by individual users and specify the time period for which you want to analyze the data.

This report can be accessed by Owner, Admin, and Manager level users. It is found under the Experimental Report sections under Reports.

Report Accuracy

The report shows periods of atypical patterns of keyboard and mouse activity that are at least 30 minutes in length. The cases listed in the report can be caused by:

  • Ways of working that are quite different (not necessarily less effective) from what is typical
  • Peculiarities of hardware or software configurations
  • Usage of software that simulates keyboard and mouse activity, intended to give the impression that a person is working when they aren’t

For a more complete picture, the content in this report should be considered along with other information about a person’s work. The provided report cannot be used as proof of user cheating, as it may not contain all cases of suspicious activity.

Frequently Asked Questions

Why doesn’t the algorithm take into account the applications used?

The algorithm focuses on actual behavior rather than applications or scripts launched. This is because it is possible to manipulate time tracking by physical devices or run an auto clicker script in the background.

Does the report capture cases of low activity?

No, the report does not capture cases of very low activity. Such cases are evident from the existing Time Doctor reports, such as the Activity Summary Report.