Event handling

Event handling

To handle an event, do the following:

1. Right-click the event in the table.
   
2. Select Acknowledge.

The event gets the Acknowledged status, and the first element is displayed in the event handling interface. After you handle each element, the next element is displayed. The last element is always the button.

There are seven different types of elements available:

1. Button.
   To continue the event handling, click the button. If this element is the last in the logic and you want to close the event handling interface after you click the button, select the Yes value in the Finish parameter during the setup of this button. For more details, see Configuring the button.
   
2. Date/time.
   In the Incident manager window, the operator can specify the date and/or time of the handled event. For more details, see Configuring the date/time.
   
   Configuration methods:
   1. Date setting:
      1. Enter the date manually.
      2. Select the date via the standard calendar window.
   2. Time setting:
      1. Enter the time manually.
      2. Adjust the time with the up and down buttons.
3. Radio button.
   To continue the event handling, select the required position. For more details, see Configuring the radio button.
   
4. List.
   To continue the event handling, select the required value from the list. There can be several lists. For more details, see Configuring the combobox.
   
5. Checkboxes.
   To continue the event handling, set one or more checkboxes. For more details, see Configuring the checkbox.
   

6. Comment.
   To continue the event handling, enter a comment and click the Send button. The name of the button is set by the user. For more details, see Configuring the button.
   

   Note

   Depending on the incident manager settings, the comment can be filled in automatically and protected from editing. For more details, see Configuring the comment.

7. Image.
   To continue the event handling, add an image and click the button. The text on the button depends on the administrator settings (see Configuring the image). In the example below, it is the Next button.
   The options of working with an element:

   1. The element already displays the image specified by the settings, or the image from the camera or the map associated with the event. The event can be associated with several cameras; hence, when the event occurs, the images are generated from each associated camera, and you must select one of them. To do this, use the following buttons:

      1. To update the image, click the + button (1). As a result, the image from the camera or the map is added at the moment when the event occurs. The button is applicable, for example, if the image has been deleted or it needs to be updated.

      2. To delete an image, click the - button (2).

      3. To scroll images, use the < and > buttons (5, 6).
         The field (3) displays the number of the selected image, and the field (4) displays the total number of image options. To go to a specific image, enter its number in the field (3).

         
         If you create and configure the Equipment detection (PPE) object for a camera, the outlines around detected objects can appear on the frame. The color and thickness of the outline are determined by the RectColor and RectLineThickness registry keys (see Registry keys reference guide).
   2. The element doesn’t have any images, and they must be uploaded. To do this, click the + button (1), and a standard Windows Explorer window opens, in which you can select an image file in JPG, PNG, or BMP format. 

After you complete all stages, the event handling interface closes, and, if it was specified in the logic settings, a report indicating the actions and the user who performed them is displayed (see Interim report).

Suspend event handling

If the operator goes to handle another event without completing the handling of the current one, the event gets the Suspended status, and the handling elements become inactive. In this case, the event is unavailable for handling by other operators.

The operator can independently suspend the event handling if the appropriate rights are given (see Configuring user rights in Incident manager). To do this, right-click the event and select Suspend:

To continue handling the suspended event, right-click the event in the table again and select Acknowledge.

Event escalation

In the settings, you can set the ability to transfer the event for handling to another operator of the system—escalation (see Configuring user rights in Incident manager).
To escalate manually, do the following:

1. Right-click the event in the table.
   

2. Click Escalate, and select to whom in the drop-down list:

   1. All—escalation to all users, that is, any user can handle the escalated event.

   2. Specific user from the list—the escalated event is assigned to the selected user.

If you don't set the option to see and work with the escalated events in the settings (see Configuring user rights in Incident manager), after escalation, the event disappears from the list and is displayed for another operator with the Escalated/<Last name of the operator who escalated it> status. In this case, the event is in the state it was at the time of escalation: if the operator started handling it, the event is at the unfinished stage.

Additionally, you can automatically escalate events after the specified time (see Selecting events to display and handle). In this case, the automatically escalated event becomes unavailable for handling by the current operator and is displayed with the Escalated/Waiting for handling status.

Handle an event group

Handling of event groups is possible if it is enabled in the Configuring event grouping in incident manager. Possible options:

1. After you handle one of the group events, all remaining events of this group are automatically closed.
2. Only the first event of a group is displayed in the event list display window. The rest of the group events are automatically closed after the first event is handled.
3. When you escalate one event of a group, all events of the group are automatically escalated.

If the operator handles an event from a group, all events of this group are locked for other operators, and new events of the group automatically change their status. In other words, all events of the selected group, including incoming new events, are available for handling only to one operator until they handle all events of a group. Other operators cannot handle events from this group: if they try to handle an event from this group, the message Group is locked is displayed.

The color of the group name can also change during group handling, see Event grouping.

Close events without handling

If you set the ability to close events without handling in the settings (see Configuring user rights in Incident manager), then two buttons are displayed in the upper right corner of the event table:

1. To close one event, select it from the table and click the Close button. 
2. The Close all button is used to close all events.
   Also, by clicking the Close all button, you can close events of one or several groups selected in the Group by table.