Off-Hours Events by Actor

Some off-hours activity is expected and legitimate — global teams, flexible working, urgent issues. But an actor where more than 25% of all their events occur outside business hours may indicate that automated processes are running under their credentials, that someone is making changes they don't want to be visible during work hours, or simply that someone is working unusual hours for personal reasons.

What you can conclude

• An actor with a very high off-hours percentage and a high absolute event count warrants a review — is this legitimate flexible working or something that needs explanation?
• A service account appearing in this list is a concern — automated processes should be operating under dedicated service accounts with defined access limits.
• Actors with modest off-hours percentages in the context of clearly flexible working arrangements require no action.

How this chart works

Horizontal bar chart ranking actors by total count of events outside business hours (before 08:00 UTC or after 18:00 UTC on weekdays, or any time on weekends), with off-hours percentage shown in the tooltip. Bars are red when the actor exceeds the 25% threshold, amber otherwise. Use the date and project filters to focus on specific periods.