Filtering and grouping alarms in Security Center - Security Center 5.11

You can filter and group alarms to control how they appear in the Alarm monitoring task and the Monitoring task.

To filter alarms:

1. In the Alarm monitoring task or the Monitoring task, click the filter icon ().
   NOTE: In the Monitoring task, you must select Alarms from the Events/Alarms toggle button. The Events/Alarms toggle button only appears when you enable alarm monitoring in the Monitoring task.

   If you cannot see the Filter () or Events/Alarms toggle button, drag the top of the canvas down to expose the alarm list that appears at the top of the screen.

   
2. Select or clear the following filters:

   Show all

   Display all alarms (no filter).

   Show active

   Show active alarms.

   Show under investigation

   Show alarms that are currently under investigation.

   Show acknowledgment required

   Show alarms where their acknowledgment conditions are cleared but they must still be acknowledged.

   Show acknowledged

   Show acknowledged alarms.

To group alarms:

1. In the Alarm monitoring task or the Monitoring task, right-click a column heading and select Group by.
   NOTE: In the Monitoring task, you must select Alarms from the Events/Alarms toggle button. The Events/Alarms toggle button only appears when you enable alarm monitoring in the Monitoring task. If you cannot see the Events/Alarms button, drag the top of the canvas down to expose the alarm list that appears at the top of the screen.
2. In the Group by dialog box, select Enable grouping.
   
3. From the drop-down list, select the highest level of grouping you would like to apply to the alarms.
   You can group the alarms by:

   Alarm

   Alarm entity name.

   Priority

   Alarm priority. All alarms imported from Omnicast have their priority set to 1 by default. You can change their priority at a later time in Config Tool.

   Source

   Source entity that triggered the alarm. It is the event source if the alarm is triggered by an event-to-action, or the user if the event is triggered manually. The source is not shown if you do not have permission to access the source entity.

   Source entity type

   The source entity type that triggered the alarm, when the alarm is triggered by an event-to-action. It shows User when the alarm is triggered manually.

   State

   Current state of the alarm.

   Active

   Alarm is not yet acknowledged. Selecting an active alarm shows the alarm acknowledge buttons in the report pane.

   Acknowledged (Default)

   Alarm was acknowledged using the default mode.

   Acknowledged (Alternate)

   Alarm was acknowledged using the alternate mode.

   Acknowledged (Forcibly)

   Alarm was forced to be acknowledged by an administrator.

   Under investigation

   Alarm that is under investigation, meaning that someone has seen it but not necessarily able to take care of it.

   Acknowledgment required

   Alarm with an acknowledgment condition that was cleared and that is ready to be acknowledged.

4. To apply additional grouping levels, select Then by.
5. Click Advanced.
6. To change the grouping order, select a group, and then use the and arrows.
   
7. Choose a sort direction for each group: click for an ascending order or for a descending order.
8. To show alarm information in the header of the group, do the following:
   1. Select a group, and then click Edit the item ().
   2. Select the alarm columns you want to show.
   3. To change the column order of appearance, use the and arrows.
   4. Click OK.
9. Click Apply.
   NOTE: The grouping and sorting configuration is saved when you close the task or application.