Event information

Information about Incident manager events is displayed in the event table located in the upper part of the interface:

You can group, filter, and sort the events. The list displays the event status, and you can handle the event from here (see Event handling).

When you open the Incident manager window, the event monitoring opens by default, which displays only the current events that require handling. To view all events of the incident manager, go to the Archive.

View current events

The following information is displayed for each event by default:

1. Indicator of the presence of the camera associated with the event .
2. #—the column displays the indicator of event locking.
   Display of locking:
   
   1. Locked remotely—.
   2. Locked locally—.
3. Event ID.
4. Handler—the name of the incident handler that handles the event.
5. Event status.
6. Object type.
7. Object ID.
8. Object name.
9. Action—description of the event.
10. Time the event occurs.
11. Priority.
12. Computer—the name of the computer from which the event is received.
13. Time (s)—the number of seconds since the event occurred.
14. Last comment—only the last comment entered while handling the event.
15. All comments—all comments entered while handling the event.
16. Additional information.

To change the displayed columns, do the following:

1. Click the button (1).
   
2. Set the checkboxes next to the columns that you want to display (2). To set checkboxes next to all columns, click the Select all button (3); to clear the checkboxes, click the Deselect all button (4).
3. Click the Apply button (5). To cancel the changes, click the Cancel button (6).

Event statuses

By default, an event is sent to the incident manager with the Waiting for handling status. Later, the event can receive the following statuses, depending on the operator's actions (see Event handling):

1. Acknowledged. This status is displayed if an event is currently being handled.
2. Suspended. This status is displayed if event handling was started, wasn't completed, and was suspended.
3. Taken by others/<Last name of the operator who handled the event>. This status is displayed if the event is being handled by another operator. 
4. Suspended by others. This status is displayed if event handling was started, wasn't completed, and was suspended by another operator.
5. Escalated. This status is displayed if the event is escalated to another operator.
   The following options are available:
   1. Escalated/Suspended by others—status immediately after escalation.

   2. Escalated/Taken by others—the escalated event is handled by another operator.

      Note

      Depending on the incident manager settings, when an event is escalated, it cannot change its status but disappears from the list for those who escalated the event.

6. Escalated/<Last name of the operator who escalated the event>. This status is displayed for the operator to whom the event is escalated.
7. Escalated/Acknowledged. This status is displayed for the operator to whom the event is escalated when they handle it.

Grouping in the event list

If grouping in the event list is enabled in the settings (see Configuring event grouping in incident manager), the events in the list are grouped by object type/object ID/event type/logic ID.

To view the events within the group, click the button.

Depending on the settings, when you expand a group, either the first event or all events of the group are displayed.

Sorting events

To sort events alphabetically, click the name of the required column, the values of which you want to sort.

Filtering events

To filter out and display specific events, do the following:

1. Click the Filters button (1).
   
2. Apply the filter in one of the following ways:

   1. Set the checkboxes next to those values in the columns by which you want to apply the filter (2). As a result, only those objects that match all the filter criteria at the same time are displayed. To clear all selected checkboxes, click the Reset button (5).

      Note

      If you want to display the events assigned to the current operator or to other operators, you must set the checkbox next to the Assigned to me or Assigned to others value in the Assigned column, respectively. If you want to display the events assigned to both the current operator and other operators, set the checkboxes next to both the Assigned to me and Assigned to others values.

   2. From the Filter mode drop-down list (3), select the search criterion:
      1. All words.
      2. Any of words.
      3. Substring.
   3. In the Text filter field, enter the object name, object ID, or the action of the event (for example, Activated) by which you want to apply the filter (4). You don't have to enter the full object name, object ID, or action. The filter displays all found matches based on the value entered in the Text filter field. To delete the entered value, click the Cancel button (6).
   4. Apply the filter to both the checkboxes and text at the same time. To do this, enter the object name, object ID, or action (4) in the Text filter field, and set the checkboxes next to the column values by which you want to apply the filter (2). As a result, events that match both the entered text and the selected checkboxes are filtered out. To clear all selected checkboxes and delete the entered value in the field, click the Cancel button (6).
3. Click the Apply button (7).

As a result, objects and events that match all selected filter criteria are displayed at a time. For example, if you set the checkboxes next to the Acknowledged and Assigned to me statuses, then all in process events that are assigned to the current user are displayed.

Example of applying the event filter by the object ID:

Event archive

To go to the event archive, click the button on the top panel. As a result, the list of archived events opens:

In the event archive, you can do the same actions as in the event monitoring mode: apply filters, use the Close and Close all buttons, generate an interim report, and select columns to display them in the table. Besides that, on the top panel, you can set the parameters for the archive display:

where:

• The period for displaying the archived events is specified by the date and time of its beginning (1) and end (2).
• The Refresh button is used to update the event list if the display period is changed (3).
• Item 6 is the number of the displayed page.
• Item 7 is the total number of pages.
• The buttons < and > are used to go to the previous/next page (5 and 8).
• The buttons << and >> are used to go to the first/last page (4 and 9).

To return to the current events, click the button.