Reviewing recorded activity
The information recorded in each session is transferred to a Microsoft SQL Server database so that it is available for querying and playback. Because the information is collected as it happens, you can monitor computers for suspicious activity or troubleshoot problems immediately after they occur.
You can also search for and play back sessions to locate past events that occurred on specific computers or that affected particular users. For example, you might be interested in activity that occurred immediately before a security breach or want to investigate the cause of an application failure. Similarly, a security expert might want to see who had access to computers with sensitive data, such as payroll information or medical records, during a particular period of time, such as the last 72 hours.