User Response Time is a sum of the averages of the following four metrics: "Connection Setup Time [msec]" + "Server Response Time [msec]" + "Total Payload Transfer Time [msec]" + "Total Retrans Delay [msec]". User Response Time estimates the average time for an application to process a TCP data request, and thus is a good measure of end-user response time.

The optional user identity feature relies on data obtained from the security event log of one of more Microsoft Active Directory domain controllers. This data can be sent directly to the appliance or it can be read by a Windows intermediary host that sends it to the appliance. The appliance interprets this data to track successful and failed login attempts by domain users on hosts within the domain. It associates this user identity information with host information to produce reports that identify users as well as hosts.