---
id: activity-analysis
name: Activity Analysis
description: Break down what has happened in this workspace, by kind of event and by account.
category: operations
pages:
  - activity
status: active
version: 1
triggers:
  - activity breakdown
  - event breakdown
  - what kind of events
  - events by type
  - who did what
  - busiest account
owliver:
  enabled: true
  suggestions:
    - label: What kinds of event are there?
      capability: table
    - label: Summarize workspace activity
      capability: summary
    - label: Activity over recent periods
      capability: flow
  capabilities:
    - summary
    - stats
    - table
    - list
    - progress
    - flow
  responses:
    summary:
      title: Activity breakdown
      source: activity.breakdown
    stats:
      title: Activity breakdown
      source: activity.breakdown
    table:
      title: Events by kind
      source: activity.breakdown
    list:
      title: Events by kind
      source: activity.breakdown
    progress:
      title: Events by kind
      source: activity.breakdown
    flow:
      title: Activity over time
      source: activity.breakdown
      periods:
        - last-7-days
        - this-month
        - previous-month
---

# Activity Analysis

## Purpose

- Report what has happened in this workspace and in what proportion.
- Count how many accounts are active.
- Show activity across recent periods.

## Capabilities

- Break events down by kind, with each kind's share.
- Count distinct event kinds and active accounts.
- Window the breakdown by period.

## Data

Reads `activity.breakdown`, which counts `UserActivity` records by `event_type`
and by account.

## Analysis

Events are counted by kind and expressed as a share of the total, because a raw
count means little without knowing whether twelve logins is most of the log or a
fraction of it.

Stored event names are machine keys; they are rendered as words so a reader does
not have to translate `hire_candidate` in their head.

## Output

Total events, number of distinct kinds, number of active accounts, then a row
per kind with its count and share.

## Limitations

- This describes the audit log, not the underlying records. Ten `apply_job`
  events mean ten logged actions, which is not a guarantee of ten applications
  surviving in the pipeline.
- Overlapping periods are deduplicated by event, so asking for today and the
  last seven days together does not double-count today.
- This counts activity; it does not judge it. Whether a pattern is unusual is
  Anomaly Detection's question.