Investigating record types - Security Center 5.13

Security Center User Guide 5.13

Product
Security Center
Content type
Guides > User guides
Version
5.13
ft:locale
en-US
Last updated
2025-01-28

You can search and combine Security Center events from different entities with data records imported from external sources in a single report using the Unified report investigation task.

Before you begin

Ensure that your system administrator has granted you the necessary privileges to:

What you should know

The Unified report is an investigation task that you can use to query the record types available to you. By default, the Security Center alarm instances, access events, camera events, and bookmarks, are available as record types. You can build complex queries based on known or suspected correlations between your record types, according to time and location.

Correlation refers to the relationship that exists between two types of events, X and Y. A correlation exists between X and Y if whenever event X occurs, event Y is expected. For example, if we observe that every time there is a large gathering of people (event X), the number of new cases of COVID-19 increases in the days that follow (event Y), we can assume that there is a correlation between large gatherings and the increase in the number of new cases of COVID-19.

NOTE: You can choose filters that aren’t applicable for every record type in your report. If a filter doesn’t apply to a record type, it’s ignored. For example, the Physical location filter is applied for the Cameras record type, but not for Cardholders.

Procedure

  1. On the Security Desk homepage, open the Unified report task.
  2. Click Record types and select the record types you want to analyze.
    Assuming that your record types correspond to event types, such as arrests or thefts, you can check the correlation between different record types by filtering them on a common property.

    By default, you can always correlate your records using their timestamp and location properties. The timestamp and location properties are fields in your records to which your system administrator has assigned the Timestamp and Location functions. More often than not, instead of having a single Location field, use a Latitude and Longitude pair that indicates the exact location where an event occurred.

    For more information on how record types are defined in Security Center, see Creating record types.

  3. To correlate your record types by timestamp, click the Event timestamp filter and specify a range of dates or times.
    This filter applies to the fields assigned to the Timestamp function in record types. To filter on other timestamp fields that aren’t assigned to the Timestamp function, you need to use the Conditions filter.
  4. To correlate your record types by physical location, click the Physical location filter and select an area from the drop-down.
  5. To correlate your record types by location, click the Geographical location filter and draw the regions in which data is to be found or excluded.
    1. Click Edit.
      A map window opens.
    2. Click Draw polygon () to start drawing.
      Click once for each endpoint, and click the first endpoint to close the polygon.
      Records report - Drawing a region.
    3. If necessary, click and drag a point to adjust the shape of the polygon.
    4. If necessary, draw more regions.
    5. Click OK to save your changes.
    6. Click Switch to map mode to change the canvas to the map display.
      The regions added as the location filter are displayed in green. Only records found within these regions are returned as results.
    7. Select the Exclude regions option to exclude the records found within these regions from the results.
      The color of the regions changes to red.
    Records report - Location filter.
  6. To add filters on fields other than timestamp and location, click the Conditions filter.
    If two record types each have a field with the same name and data type, conditions applied to that field apply to both record types. If you add a condition for a field that doesn’t exist in some record types, that condition has no effect on those record types.
    1. Click Add an item () under the Conditions filter.
      The Condition dialog box opens.
    2. Click the record type and the field that you wish to filter.
      Records report - Add a condition.
      NOTE: When you select a Security Center event category as a record type, the custom fields associated to the related entity types become available as condition filter. For example, if you select Access events, the custom fields associated to door, elevator, cardholder, visitor, and credential entities are available. Note the following limitations:
      • You can’t filter by door side.
      • Image custom fields aren’t supported.
      • Encrypted custom fields aren’t supported.
      • Only the Equal to (=) operator is supported for custom fields.
    3. Select a comparison operator and a value, and then click Add.
      NOTE: Enter string values without using double quotes.

      For the In and Not in operators, enter a list of comma-separated values without adding a space after the comma, unless the space is part of the value you want to match.

      For the pattern matching operator, enter the value as a regular expression.
      • Click Pattern matching options > General for a list of the most commonly used metacharacters.
      • Click Pattern matching options > ALPR to transform a license plate number you entered into a regular expression for matching OCR-equivalent characters, such as '8' and 'B', '1' and 'I', and '0' and 'O' and 'D'.
      The condition is added to the Conditions filter.
    4. Add more conditions on the same or different fields as needed.
  7. Click Generate report.
    The query results are displayed in the report pane. Right-click on any column header to add or remove columns from the report as needed.
  8. Double-click a row to display it in a tile in the canvas.
    Records report - Results displayed in tiles.
  9. If the record types are georeferenced, click Switch to map mode to display the results on the map.
  10. Click a map object of a record type to open the information bubble with the details of the record.