An intentional action is a user-driven event that reflects a deliberate choice, such as submitting a prompt, clicking a control, approving a request, or launching a command. It is more meaningful than background activity like autosyncs, refreshes, heartbeats, or other machine-generated noise. In telemetry, this distinction helps separate real use from passive app behavior.
In cyber security, intentional actions matter because they are often the events that change risk or prove engagement. Defenders use them in logs, detection rules, and product analytics to identify true user activity, measure adoption, and spot suspicious behavior such as account misuse or scripted automation. Attackers may try to imitate intentional actions to blend in, so analysts look at context, timing, repetition, and follow-on effects. Counting intentional actions, rather than raw event volume, gives a clearer view of whether a system is being used by a person or merely generating background traffic.