How should automated activity be distinguished from human action?¶

Automated activity should be distinguished from human action by examining the mechanism, trigger, pattern and surrounding evidence.

No single field will always answer the question.

Avoid this assumption: That regular activity is automated and irregular activity is human. Either pattern can be misleading.

Automation may run on a fixed schedule, after another event or whenever a device reconnects. Human activity can also be repetitive, especially where a person follows a routine or uses a tool repeatedly.

Investigators should identify the process, application, account and session involved. Look for scheduled tasks, service accounts, APIs, scripts, synchronisation services and background processes.

Timing can help. Exact intervals, continuous operation and activity during periods when no user was logged in may support automation. But they are not conclusive.

Human interaction may leave supporting events such as keyboard or interface activity, interactive login, window focus, application navigation or confirmation prompts. Automated activity may show machine user agents, repeated request structures, service principals or parent processes associated with scripts.

The key question is what normally causes the event. Ask system owners or specialists whether the same record can be produced manually, automatically or both.

Preserve process ancestry, command lines, request IDs, task definitions, API logs and session information. Compare the disputed activity with known normal behaviour from the same system.

Where the evidence supports only one explanation, say so. Where both remain possible, report the limitation rather than forcing attribution.

Operational takeaway¶

Distinguishing automation from human action requires correlation of process, trigger, session and behavioural evidence, because neither timing patterns nor account names alone reliably identify the cause.