The card displays a graph entitled History chart (all activities) that provides an overview of user activity for a certain period.

One can choose from the following periods:

This graph provides an insight into user’s actions for the selected period, with a detailing of down to one day. It displays several curves representing the number of allowed and denied user actions:

To view numeric readings, hover your mouse over a curve above a marker. A pop-up window will appear that indicates the selected marker (the day, week, or month), and also displays the numbers of allowed and denied user actions for the time corresponding to this marker. The values in parentheses indicate the average number of actions for the group in which the user is selected (see Group averages).

By default, the graph displays all curves. To hide a curve, click its identifier below the graph. For example, if you are interested in only “denied” curves, you can hide the “allowed” curves by clicking their identifiers. To display the curve again, click its identifier once more.

Each curve in the graph is complemented by a dashed curve representing the group averages. When a main curve is hidden, its complementary average curve is not displayed as well.

In addition to the number of actions of the selected user, the history chart also displays the average values for the group of which this user is a member. Each of these group averages is an average number of respective actions by the group members (an average number of allowed / denied attempts to access devices / protocols). When calculating a group average, the boundary values of the source data are truncated to prevent distortion due to the highest and lowest values in the group.

The group averages serve to compare the user’s activity metrics to those of their coworkers group. Abnormal deviations from the average metrics may indicate suspicious user actions. This is the case, for example, when the number of the user’s denied actions is substantially higher than the respective group average.

Group averages are indicated by dashed lines of the corresponding color. For example, the average number of denied attempts to access devices is indicated by a dashed line of the same color as the curve representing the number of the user’s denied attempts to access devices. This design makes it easier to compare user metrics to their group averages.

If you are not interested in averages, click the Group’s average label below the graph to hide this information. To display the averages again, click this label once more.

The group averages depend upon the group in which the user is selected. Note that in order to select a user, you must first expand a group, and then select a user from that group. The graph displays the averages for the group that is used for selection.

Since the user can be a member of multiple groups, group averages may vary depending upon how the user is selected. For example, if a user is selected from the list of members of the built-in group All, the averages are calculated for all users registered with the server’s logs. If you select a user from the list of members of a custom group, the averages are calculated only for the member users of that group.