It records which user actively uses which application and for how long in user and server systems. Since he works at the place where the incident took place, he can access much more detailed records. Examples of events that can be tracked with Application Monitoring:
Tracking how long the user has run which application — for example, how much work has been done on an Excel document?
How much time was spent “actively” on YouTube or social media sites?
Monitoring of confidential web activities — Monitoring of web activities without using Firewall or Proxy server or over VPN, or monitoring of Internet transactions through a mobile phone connected to a computer
Monitoring the usage of applications such as TOR, VPN, Periscope
How long was it spent without doing anything on the computer?