To start processing an event, do the following:
After that, the first element will be displayed in the event handling interface. After processing each element, the next element will be displayed. The last element will always be the button. There are 6 different types of elements available:
An event with the Acknowledged status is available for processing only by the operator who took it. To release an event without processing, right-click the event and select Release: |
After you complete all the stages, the event processing interface will close and, if it was specified in the logic settings, a report will be displayed indicating the actions and the user who performed them (see Interim report).
If the Operator proceeds to process another event without completing the processing of the current event, the event will have the Suspended status, and the processing elements will become inactive. In this case, the event will be unavailable for processing by other operators.
The operator can independently suspend the processing of an event if the appropriate permissions are given (see Configuring user rights in Incident manager). To do this, right-click on the event and select Suspend:
To continue processing the paused event, right-click on the event in the table again and select Acknowledge.
The ability to escalate an event for processing by another operator of the system can be enabled in the settings (see Configuring user rights in Incident manager). Escalate the event as follows:
Select Escalate and then select the required Incident manager interface.
The selected Incident manager should be open on the screen, otherwise the event will not be escalated. |
After escalation, the event will disappear from the list and will be displayed for another operator with the Escalated/<Last name of the operator who escalated it> status. In this case, the event will be in the state that was at the time of escalation: if the operator started processing, then the event will be at an unfinished stage of processing.
Processing an event group or event filter is possible if it is enabled in the Configuring the events grouping in Incident manager. Possible options:
If the ability to close events without processing them is enabled in the settings (see Configuring user rights in Incident manager), then 2 buttons are displayed in the upper right corner of the events table: