You can use records imported from external sources to derive new information in Security Center using the Records investigation task.
Before you begin
What you should know
Correlation refers to the relationship that exists between two types of events, A and B. A correlation exists between A and B if whenever event A occurs, event B is expected. For example, if whenever there is a large gathering of people, the number of new cases of COVID-19 increases in the following days, we can say that there is a correlation between large gatherings and the increase of the number of new cases of COVID-19.
- On the Security Desk home page, open the Records task.
Click Record types and select the record types you want to
Assuming your record types correspond to types of event, such as arrests or thefts, you can test whether a correlation exists between two record types by filtering them on a common property.NOTE: By default, the timestamp and the location properties are always available for correlation. The timestamp and location properties are the fields that your system administrator assigned the Timestamp and Location (or Latitude and Longitude) functions to. The actual field names might be different.
To correlate your record types by timestamp, click the Event
timestamp filter and specify a range of dates or times.
Use this option to filter the fields assigned to the Timestamp function in the record type. If you have other timestamp fields in your record type that are not assigned to the Timestamp function, you must specify them in the Conditions filter.
To correlate your record types by location, click the Location
filter and draw the regions where the data must be found or excluded from.
A map window opens.
Click Draw polygon () to start
Click once for each endpoint, and click the first endpoint to close the polygon.
- If necessary, click and drag a point to adjust the shape of the polygon.
- If necessary, draw more regions.
- Click OK to save your changes.
Click Switch to map mode to change the canvas to the map
The regions added as location filter are displayed in green. Only records found within these regions are returned as results.
To exclude the records found within these regions from the results, select the
Exclude regions option.
The color of the regions changes to red.
- Click Edit.
To add conditions on fields other than timestamp and location, click the
If two record types each have a field with the same name and data type, conditions applied to one field are also applied to the other. If you add a condition for a field that doesn't exist in some record types, those records are not filtered based on that condition.
Click Add an item () under the
The Condition dialog box opens.
Click the record type and the field you want to filter.
Select a comparison operator and a value, and then click
NOTE: Enter string values without using double quotes.
For the In and Not in operators, enter a list of comma-separated values without adding a space after the comma, unless the space is part of the value you want to match.For the pattern matching operator, enter the value as a regular expression.
The condition is added to the Conditions filter.
- Click for a list of the most commonly used metacharacters.
- Click to transform a license plate number you entered into a regular expression for matching OCR-equivalent characters, such as '8' and 'B', '1' and 'I', and '0' and 'O' and 'D'.
- Add more conditions on the same or different fields as needed.
- Click Add an item () under the Conditions filter.
Select the columns you want to see in your report.
Six columns are included by default:
NOTE: Fields with the same name and type are considered to be identical in all record types and can only be included once in the report.
- Corresponds to the fields assigned to the ID function.
- Record type
- Name of the record type the record belongs to.
- Corresponds to the fields assigned to the Timestamp function and used for the Event timestamp filter.
- Latitude, Longitude
- These two columns correspond to the fields assigned to the Location (or Latitude and Longitude) functions and are used for the Location filter.
- Name of the role that manages the record type.
Click Generate report.
The query results are displayed in the report pane.
Double-click a row to display it in a tile in the canvas.
- If the record types are georeferenced, click Switch to map mode to display the results on the map.
Click a map object of a record type to open the information bubble with the details of