Abstract: Methods, apparatus, and systems for analyzing user-activity data are disclosed. In one disclosed embodiment, for example, two or more data streams of low-level, user-activity data are detected at a computer workstation via two or more respective sensors. The two or more respective sensors may comprise a first sensor configured to detect network-access requests and a second sensor configured to detect at least one of the following events: file-activity events, window-title-change events, or user-interface events. Targeted user activity is identified from at least one of the data streams. The targeted user activity can comprise, for example, a user initiating a network access; performing a search on a search engine; creating, opening, or modifying a file; or initiating a network access that causes a window title to change.