Focused image grabbing

A computer-based method comprising:

• monitoring user activities at an endpoint device on a computer network;
• determining if one of the user activities at the endpoint device presents a potential threat to network security;
• creating an alert of the potential threat;
• and
• providing the alert with a redacted version of a screenshot from the endpoint device, wherein one or more open windows on the screen of the endpoint device are obscured or removed in the redacted version of the screenshot of the endpoint device,
• wherein providing the redacted version of the screenshot comprises:
• receiving data that describes physical characteristics of the one or more open windows from an operating system of the endpoint device;
• receiving a full screenshot of the screen of the endpoint device;
• and
• obscuring the one or more open windows by creating one or more visual covers, wherein each of the visual covers is sized and shaped to match a size and shape of a corresponding one of the one or more open windows based on the data that describes the physical characteristics of the one or more open windows and placing each of the one or more visual covers over the corresponding one of the one or more open windows.