An incident trigger is an event or a sequence of events that can trigger an incident. The Genetec Mission Control™ Rules Engine looks for specific combinations of events (type, time, correlation, and frequency) to determine whether to trigger an incident.
- Each incident trigger characterizes one incident type (not all incident types have a trigger because not all incidents can be detected automatically by the system).
- Each incident trigger is defined by a sequence of event qualifying rules.
- Each event qualifying rule is defined by one or many event qualifiers.
- Each event qualifier is defined by an event type and an event source.
- You can add the following event correlation constraints to an event
- The events defined in the rule must occur n times. The occurrence of any event that qualifies, counts towards the total number of event occurrences.
- This constraint can be applied in one of the following ways:
- Used with the Occurrence constraint, you can define the time frame in which the n occurrences of qualified events must happen.
- Used without the Occurrence constraint, you can define the maximum time lapse between the satisfaction of a previous rule and the satisfaction of the current rule. This is only applicable if no previous rule uses the Interval constraint. A previous rule is tied to the current rule through the Interval constraint by specifying the event that satisfied the previous rule (example: "Less than <x> seconds after <event>"). If the Interval constraint is disabled if it does not apply.
- Event filtering
- Two event correlation constraints are available:
- No other events occur at the source
- No events other than the qualifying events specified in the rule may occur at the same source during the specified time frame. For example, if the event qualifier specifies that Access denied at Door A must occur three times within 30 seconds without an occurrence of another event at the source, then the event Access granted at Door A before the 30 seconds is over, resets the occurrence counter. However, an occurrence of the event Access granted at Door B has no effect.
- These specific events can occur at the source
- No events other than the qualifying events specified in the rule and the specific ones listed here, may occur at the same source during the specified time frame.
- If the qualifying events specified in the rule are from different sources, it is the source of the last qualifying event that is considered when applying the event filters.