The present disclosure is directed to systems and methods for generating investigations of user behavior. In an example embodiment, the system includes a video camera configured to capture video of user activity, a video analytic module to perform real-time video processing of the captured video to generate non-video data from video, and a computer configured to receive the video and the non-video data from the video camera. The computer includes a video analytics module configured to analyze one of video and non-video data to identify occurrences of particular user behavior, and an investigation generation module configured to generate an investigation containing at least one video sequence of the particular user behavior. In some embodiments, the investigation is generated in near real time. The particular user behavior may be defined as an action, an inaction, a movement, a plurality of event occurrences, a temporal event and/or an externally-generated event.