System and method to visualize user sessions

A system to visualize a user session, the system including:

• an identifier operable to identify a persistent event from among a plurality of software-related events, the persistent event persisting for a period of time that includes others of the plurality of software-related events;
• a comparator configured to compare the persistent event to the others of the plurality of software-related events;
• and
• a determiner configured to determine whether any of the others of the plurality of software-related events have a timestamp during the period of time.

A method to carve out and visualize a user session on a network, the method comprising the steps of:

• importing a plurality of time-based events;
• sorting the plurality of time-based events in chronological order;
• determining whether each one of the plurality of time-based events is one of a user logon event and a user log off event;
• creating a new user session metadata object for each one of the plurality of time-based events that is the user logon event;
• determining whether at least one of the time-based events occurred after the user logon event;
• and
• displaying a list containing identification information of a user associated with the user logon event if the at least one of the time-based events occurred between the user logon event and before a corresponding user log off event.