Interactive and automatic activity
An audit log records what a service did, not what a person did. Outlook does not wait for anybody: it synchronises mail, opens attachments to index them, applies labels — and each of those writes an event with a timestamp and an address, indistinguishable in shape from a click.
On one real 132,867-event export, two operations account for 68.6% of the whole file:
| Operation | Events | Share |
|---|---|---|
MailItemsAccessed |
89,879 | 67.6% |
AttachmentAccess |
1,268 | 1.0% |
Those two are the only operations Corelog ships as automatic. The list is deliberately short: several others look automated by name and some probably are, but excluding an operation on a hunch removes real activity from somebody’s figures, and these are the pair whose effect has been measured end to end.
Why the address cannot answer this
Section titled “Why the address cannot answer this”There are two separate questions, and neither filter answers the other:
- Did a person cause this? Only the operation can say.
- Does the address place them somewhere? Only the network can say.
The same export shows why. 63% of MailItemsAccessed events arrive from the account’s own
declared network — it is Outlook synchronising on their own laptop, so no address-based
rule can separate them from human activity. Conversely CopilotInteraction is something a
person really did, and 92% of those events carry a Microsoft address rather than the
person’s.
So Corelog applies both signals, independently. See Addresses and networks for the other one.
What the classification changes
Section titled “What the classification changes”Excluding an operation affects three things, and nothing else:
- The
All activity/Interactivetoggle in the toolbar, which filters every view. - Time spent working, where counting background sync produced 1,655 hours over six months and a peak week of 103.4 out of the 168 a week contains.
- The Bulk Operations detection, where 942 of the 991 bursts in that export were a mail client synchronising.
It does not change the event counts on the report cover, the activity matrix, or any other detection. The totals always describe the whole file.
It is not only about hours
Section titled “It is not only about hours”The effect on location is larger than the effect on time. A same-day-two-countries check over that export fires on:
| Days flagged | |
|---|---|
| Counting every event | 129 of 183 |
| Counting only interactive events | 4 |
Three of those four remaining days are the genuine finding. The other 125 were Exchange infrastructure.
Changing the list
Section titled “Changing the list”The classification is yours to adjust. Open the operation configuration panel, which lists every operation in your file with its volume, and move any of them between interactive and automatic. The audit report prints the list that produced its figures — including operations you put back, marked as such — because a list that does not match the calculation is not evidence of anything.
Anything not named is treated as interactive. The asymmetry is deliberate: leaving a background operation in overstates how long somebody worked, which an analyst will notice; taking a real one out understates it silently.