Processing events

To start processing an event, do the following:

  1. Right-click on an event in the table.
  2. Select Acknowledge.

After that, the first element will be displayed in the event handling interface. After processing each element, the next element will be displayed. The last element will always be the button. There are 6 different types of elements available:

  1. Button. To continue processing the event, click the button. If this element is the last in the logic, then after clicking the button, the event processing will be completed.
  2. Radio button. To continue processing the event, select one of the values.
  3. List. To continue processing the event, select the required value from the list. There can be several lists.
  4. Checkboxes. To continue processing the event, set one or more checkboxes.
  5. Comment. To continue processing the event, enter a comment and click the button.
  6. Image. To continue processing the event, add images and click the bottom button (the Next button in the image below). By default, the image specified in the settings is displayed. To select another image, click the ... button; to use an image from the memory buffer, click the Paste button.

An event with the In operation status is available for processing only by the operator who took it. To release an event without handling, right-click the event and select Release:

After you complete all the stages, the event processing interface will close and, if it was specified in the logic settings, a report will be displayed indicating the actions and the user who performed them (see Interim report).

If the processing was interrupted, the event will have the Paused status, and processing elements will become inactive. To continue processing the paused event, right-click on the event in the table again and select Acknowledge.

Escalating events

The ability to escalate an event for processing by another operator of the system can be enabled in the settings (see Configuring the main parameters of the Incident manager). Escalate the event as follows:

  1. Right-click on an event in the table.

  2. Select Escalate and then select the required Incident manager interface.

    The selected Incident manager should be open on the screen, otherwise the event will not be escalated.


After escalation, the event will disappear from the list and will be displayed for another operator with the Escalated/<Last name of the operator who escalated it> status. In this case, the event will be in the state that was at the time of escalation: if the operator started processing, then the event will be at an unfinished stage of processing.

Processing event group or event filter

Processing an event group or event filter is possible if it is enabled in the settings of filtering and grouping of events in the Incident manager. Possible options:

  1. After processing one of the filter events, all remaining events of this filter will be automatically closed.
  2. Only the first event of the group is displayed in the event display window. The rest of the group events will be automatically closed after the first event is processed.

Closing events without processing

If the ability to close events without processing them is enabled in the settings (see Configuring the main parameters of the Incident manager), then 2 buttons are displayed in the upper right corner of the events table:

  1. Close. It is used to close one event; select the required evet in the table and click this button.
  2. Close all. It is used to close all events.