Events processing

Event processing

To start event processing, do the following:

1. Right-click the event in the table.
   
2. Select Acknowledge.

The event gets the Acknowledge status, and the first element is displayed in the event processing interface. After processing each element, the next element will be displayed. The last element will always be the button. There are seven different types of elements available:

1. Button.
   To continue the event processing, click the button. If this element is the last in the logic and you want to close the event processing interface after clicking the button, select the Yes value for the Finish parameter during the setup of this button. For more details, see Configuring the button.
   
2. Date/time.
   In the Incident manager window, the operator can specify the date and/or time of the processed event. For more details, see Configuring the date/time.
   
   Ways of how you can set it up:
   1. Date setting:
      1. Manual date entry.
      2. Selecting a date via the standard calendar window.
   2. Time setting:
      1. Manual time entry.
      2. Adjusting with up and down buttons.
3. Radio button.
   To continue the event processing, set the radio button in the required position. For more details, see Configuring the radio button.
   
4. List.
   To continue the event processing, select the required value from the list. There can be several lists. For more details, see Configuring the combobox.
   
5. Checkboxes.
   To continue the event processing, set one or more checkboxes. For more details, see Configuring the checkbox.
   

6. Comment.
   To continue the event processing, enter a comment and click the Send button. The name of the button is set by the user (see Configuring the button).
   

   Note

   Depending on the incident manager settings, the comment can be filled in automatically and blocked from editing. For more details, see Configuring the comment.

7. Image.
   To continue the event processing, add an image and click the button. The text on the button depends on the administrator settings (see Configuring the image). In the example below, it is the Next button.
   The options of working with an element:

   1. The element already displays the image specified by the settings or the image from the camera or the map associated with the event. The event can be associated with several cameras, hence, when the event occurs, the images are generated from each associated camera, and you must select one of them. To do this, use the following buttons:

      1. To update the image, click the + button (1). As a result, the image from the camera or the map will be added at the moment when the event occurs. The button is applicable, for example, if the image has been deleted or it must be updated.

      2. To delete an image, click the - button (2).

      3. To scroll images, use the < and > buttons (5, 6).
         The field (3) displays the number of the selected image, the field (4) displays the total number of image options. To go to a specific image, enter its number in the field (3).

         
         If you create and configure the Equipment detection (PPE) object for a camera, the borders around detected objects can appear on the frame. The border color and thickness are determined by the RectColor and RectLineThickness registry keys (see Registry keys reference guide).
   2. The element doesn’t have any images, and they must be uploaded. To do this, click the + button (1), and a standard Windows Explorer window will open, in which you can select an image file in JPG, PNG, or BMP format. 

After you complete all stages, the event processing interface will close, and, if it was specified in the logic settings, a report indicating the actions and the user who performed them will be displayed (see Interim report).

Suspending event processing

If the operator goes to process another event without completing the processing of the current one, the event gets the Suspended status, and the processing elements become inactive. In this case, the event is unavailable for processing by other operators.

The operator can independently suspend the event processing if the appropriate permissions are given (see Configuring user rights in Incident manager). To do this, right-click the event and select Suspend:

To continue processing the suspended event, right-click the event in the table again and select Acknowledge.

Event escalation

In the settings, you can set the ability to escalate an event for processing to another operator of the system—escalation (see Configuring user rights in Incident manager).
To escalate manually, do the following:

1. Right-click the event in the table.
   

2. Click Escalate, and select to whom in the drop-down list:

   1. All—escalation for all users, that is, any user can take the escalated event into processing.

   2. Specific user from the list—the escalated event is assigned to the selected user.

If you don't set the option to see and work with the escalated events in the settings (see Configuring user rights in Incident manager), after escalation, the event will disappear from the list and will be displayed for another operator with the Escalated/<Last name of the operator who escalated it> status. In this case, the event will be in the state as it was at the time of escalation: if the operator started processing, the event will be at the unfinished stage.

Additionally, you can automatically escalate events after the specified time (see Selecting events to display and handle). In this case, the automatically escalated event will become unavailable for processing by the current operator and will be displayed with the Escalated/Waiting for processing status.

Event group processing

Event group processing is possible if it is enabled in the Configuring events grouping in Incident manager. Possible options:

1. After processing one of a group events, all remaining events of this group will be automatically closed.
2. Only the first event of a group is displayed in the event list display window. The rest of the group events will be automatically closed after the first event is processed.
3. When you escalate one event of a group, all events of a group are automatically escalated.

If the operator processes an event from a group, all events of this group will be blocked for other operators, and new events of a group will automatically change their status. In other words, all events of the selected group, including incoming new events, will be available for processing only to one operator until they process all events of a group. Other operators cannot process events from this group: if they try to process an event from this group, the message Group is blocked will be displayed.

The color of the group name can also be changed at the group processing, see Grouping events.

Closing events without processing

If you set the ability to close events without processing in the settings (see Configuring user rights in Incident manager), then two buttons are displayed in the upper right corner of the event table:

1. The Close button is used to close one event; select it in the table and click the button.
2. The Close all button is used to close all events.