Incident Manager configuration tabs - Mission Control 3.2.0.0

You can configure the settings for the Genetec Mission Control™ Incident Manager role from the Roles view of the System task in Security Center Config Tool.

Incident Manager - Properties

On the Incident Manager Properties page, you can configure the general settings for the Incident Manager role.

Retention period

Specify how long you want to keep incidents in the system after they are closed. This value can be individually defined for each incident type.

Priorities

You can add custom values to the predefined incident priorities: Low, Medium, High, and Critical. Use the arrow buttons to change the order of the priorities. You cannot rename or delete the predefined priorities. Incidents that have a higher Priority will be queued at the top of the list. Higher priority incidents also auto-open first.

Profiles

Auto-assign mode: Enable this option to let the system automatically assign incident management profiles to users when they log on.

Document management

You must configure the document location before you can add support documents for Mission Control.

Document API port: Port (default=5090) used by the role to upload and download web documents.

Export settings

You can configure the export settings for your incident.

Branding image

By default, the incident exports include the Mission Control logo. You can choose one of the following options to appear on your incident exports:

None: No branding logo.
Genetec Mission Control™ logo: The default Mission Control logo.
Custom logo: Your own logo. You can click the folder icon and choose an image with 256 x 256 pixels or above in size. The image is resized to 300 x 300 pixels with the same aspect ratio.

Location for exporting incident on close

Set the folder path to save incidents exported automatically by the system when they are closed.

NOTE: Default folder path: C:\ProgramData\Genetec Security Center <version>\

Format for exporting incident on close

Set one of the following file formats for incidents exported automatically by the system when they are closed:

PDF (default)
XML
HTML

Trigger incident settings

Choose one of the following time stamp options for incidents triggered manually in the Incident monitoring task:

When incident is triggered: When you click Trigger in the Trigger incident dialog box (default).
When manual incident trigger dialog box opens: When the Trigger incident dialog box opens after you click Trigger incident.

NOTE: If you have users logged in to Security Desk, they must log off and log on again for the changes to take effect.

Additional fields

You can add additional fields to incident properties. Every additional field you add can be viewed in the Incident details pane in Security Desk.

Mission Control includes the following default data types for additional fields:

DateTime: Gregorian calendar date and time.
Date: Gregorian calendar date.
Boolean: Boolean data, represented by a check box.
Number: Real numbers from -100000 to 100000.
String: An alphanumeric string.
URL: Web page URL that can be configured with dynamic fields pointing to specific pages based on Custom fields, Additional fields or Incident properties.

You can use these additional fields in the following ways:

Enable the system to automatically select a dynamic SOP step option.
As a parameter in the Conditional activities automation workflow activity.
As a filter criteria in the Incident report task.
As an incident list column in the Incident monitoring task.

Watch this video to learn more. Click the Captions icon (CC) to turn on video captions in one of the available languages.

Custom column: Alarm context

Starting with Mission Control 3.1.1.0, the Alarm context column which displays the context of a triggered alarm in the incident list is displayed by default and does not need additional configuration.

Incident Manager - RabbitMQ

RabbitMQ is the message broker software used by Mission Control and other Security Center components.

Username

Your RabbitMQ web interface logon username.

Password

The password for your RabbitMQ web interface logon.

Servers

RabbitMQ Servers: The RabbitMQ server runs on your main server by default. If your RabbitMQ server runs on a different server, change it here. If you have set up a RabbitMQ cluster, add the IP address of all your RabbitMQ servers here.
Port: By default, RabbitMQ uses port 5671 for SSL communication.
HTTPS API port: By default, the web management SSL port is15671.

NOTE: If you want to change the default port numbers used by Mission Control, you must either change it during the installation process or change the port in the RabbitMQ.conf file. After modifying the RabbitMQ.conf, you must update the details here to match.

NOTE: If RabbitMQ is not installed on the same server as the Incident Manager role, copy the RabbitMQ certificates to the Incident Manager server.

Failover configuration

Enable failover

Enable this option to configure the RabbitMQ servers for failover with the Incident Manager server. During the failover, data from incident triggers are lost until the Incident Manager server role is online.

RabbitMQ server assignment

Incident Manager Servers: By default, the main server is selected. Select the server which is to be configured for failover.
RabbitMQ servers: Select one or multiple RabbitMQ servers that are available to be the failover servers.

Incident Manager - States

On the Incident Manager States page, you can configure the incident states. You can modify the transition rules for the predefined states for incidents and add custom states to suit your specific needs, but you cannot rename or delete the predefined states.

The predefined incident states are:

New: The incident has been triggered and no activity is recorded. If using the default settings, you can change a new incident to In progress or Closed.
In progress: Actions are being taken for this incident. If using the default settings, you can change an incident from In progress to any other state.
On hold: The incident is paused. For example, you might do this if higher priority incident requires your attention, or if you are waiting for external information before moving forward with the procedure. When changing the state of an incident to On hold, indicate for how long you want to pause the incident and click Apply. The State field in the incident list and the incident details pane will display the time remaining for the On Hold state. The incident reverts to its original state when the hold time expires. The maximum amount of time an incident can be put on hold is 20 days(480 hours). If using the default settings, you can change an incident from On hold to any other state.
Resolved: The situation is resolved and ready to be closed. If using the default settings, you must complete all the steps in the standard operating procedure (SOP) before you can set an incident to Resolved. You can change the incident from Resolved to any other state.
You need the Forcibly resolve incidents with incomplete SOPs privilege to resolve incidents without completing all the steps in the SOP.
Closed: Everything that needs to be done for this incident has been done. If using the default settings, you must resolve an incident before you can close it. After an incident is closed, you can no longer make any changes to it. Closed incidents are removed from the Incident monitoring task, but all information remains available in the system for auditing, investigation, and analysis.
You need the Forcibly close unresolved incidents privilege to close unresolved incidents.

Incident Manager - Events

On the Incident Manager Events page, you can configure Security Center events to be processed by Mission Control.

From the Available events list you can choose one of the following options:

All: Configure Mission Control to process all incoming Security Center events.
Specific: Select one or more specific Security Center events for Mission Control to process.; For more details, see Specifying allowed events for Mission Control

Incident Manager - Resources

On the Incident Manager Resources page, you can configure the servers and database assigned to this role.

Servers: Servers hosting this role. All must have access to the role database.

Database status

Current status of the database.

Database server

Name of the SQL Server service. The value (local)\SQLEXPRESS corresponds to Microsoft SQL Server Express Edition installed by default with Security Center Server.

Database

Name of the database instance.

Actions

You can perform the following functions on the role database:

Create a database (): Create a new database with the option to overwrite the existing one.
Delete the database (): Delete the database.
Database info (): Show the database information.
Notifications (): Set up notifications for when the database space is running low.
Backup/Restore (): Back up or restore the database.

IMPORTANT: When you restore the Incident Manager database, the icons for your incident types are not restored because they are stored in the Directory database with the Incident Manager role settings.

Watch this video to learn more. Click the Captions icon (CC) to turn on video captions in one of the available languages.

NOTE: Although we do our best to keep our videos current, the information presented in this video might become outdated with each new release. If you find anything wrong with this video, feel free to contact us.