Configuring incident triggers for Mission Control - Mission Control 3.2.0.0

To allow Genetec Mission Control™ to automatically detect and trigger incidents based on the data (events) collected by Security Center, you must configure the incident triggers.

1. On the incident Triggers page, click Add event ().
   The Event qualifying rule dialog box opens.

   

2. Select the event (event type and event source) that must occur in order to trigger this incident.
   IMPORTANT: Make sure that the selected event source matches the event type, or no event will qualify. For example, a door event must be matched with a door entity, and a credential event must be matched with a credential entity.
3. If the incident can be triggered by different events, click the button beside Events to add more events.
4. The Logical mode field appears with options to specify how events can trigger the incident.
   • or: The incident is triggered when any event occurs.
   • and: The incident is triggered when all events occur within the configured time and regardless of their order.

   You can also specify more than one source for the same event type. In the following example, the Access denied door event can occur either at the Front door or at the Back door and all Access denied cardholder events from the specified source also qualify. Both event types should occur in less than 6 seconds of each other to fulfill the event trigger rule.

   

   Tip: (Optional) Turn on the Advanced event filtering option to add precision to your incident trigger configuration.

   For more details, see Events as incident triggers

5. (Optional) Click the button beside Conditions to add event correlation constraints.
   In the following example, three constraints have been added to the event qualifiers:

   • The configured Access denied events must occur at least three times (any specified events can qualify).
   • The third event occurrence must take place within 60 seconds of the first event occurrence.
   • No other events from the source can occur within this time frame.

   

6. Click Save.
   A summary of your first event qualifying rule is displayed on the Triggers page.

   

7. (Optional) Click Add event to add more event qualifying rules.
   The event qualifying rules are evaluated in sequence by the Mission Control Rules Engine. The first rule must be satisfied before the second rule is evaluated. You can add as many rules as you need.

   

   CAUTION:

   For subsequent event qualifying rules, you can specify Previous source as the event source for your event qualifiers. If you do this, make sure that the event type you select is compatible with the event source, or no event will qualify. For example, a credential event never occurs at a door.

   Tip: If you are not sure, select Specific source, and verify that the previous source is found in the list of available entities before changing it back to Previous source.
8. (Optional) You can set Additional trigger properties such as restrictions on multiple active incidents in the Incident monitoring task using one of the following options:

   Effective

   Select the time period during which the system can trigger the incident. The default schedule selected is Always.

   The schedules are configured in System > Schedules. If the selected schedule is invalid, default schedule is assigned.

   NOTE: The schedule selected does not apply when the incident is triggered manually.

   Restrict multiple occurrence to

   Set or remove restrictions on multiple active incidents in the Incident monitoring task using one of the following options (default=One per location):

   No restriction

   Select this option to allow multiple active incidents of the selected incident type.

   One per location

   Select this option to allow only one active incident per incident type per location.

   One per area

   Select this option to allow only one active incident per incident type per area.

   One per location per category

   Select this option to allow only one active incident per selected incident type under the selected incident category per location.

   One per area per category

   Select this option to allow only one active incident per incident type under the selected incident category per area.

   One per source

   Select this option to allow only one active incident per incident type per source.

   NOTE:

   • You can also right click an incident type or category in the Incident configuration page of the Config Tool to set the Restrict multiple occurrence to for the incident type or all incident types under selected category.
   • The Restrict multiple occurrence to selection is applicable only to incidents triggered by an event through the Mission Control Rules Engine or the incident automation workflow. It does not apply to incidents triggered either manually in the Incident monitoring task or through the Mission Control Web API.

   Aggregate events

   Enable this toggle to automatically aggregated events of an incident without using an automation workflow. Manually triggered incidents without selecting a source will not aggregated events. If this option is enabled, all events are aggregated depending on the Restrict multiple occurrence to option:

   No restriction

   No aggregation of events.

   One per location

   Aggregates all events occurring on the location.

   One per area

   Aggregates all events occurring on the area of the location.

   One per location per category

   Aggregates all events occurring on the location.

   One per area per category

   Aggregates all events occurring on the area of the location.

   One per source

   Aggregates all events occurring on the source.

   Restrict trigger to source entity types

   Custom events and other events which apply to multiple source entities can be configured to restrict the incident trigger to specific source entity types. Select one of the following:

   None

   By default, no restrictions for the trigger is selected.

   Specific

   Select this option to restrict the incident trigger to dynamic and static sources. Choose the entity type from the drop-down list. Click to add multiple entity types.

9. Click Apply.
   Tip: You can also schedule an incident trigger from System > Scheduled tasks in Config Tool.

   For more details, see Scheduling a task in the Security Center Administrator Guide.