Investigating record types - You can search and combine Security Center events from different entities with data records imported from external sources in a single report using the Unified report investigation task. - Security Center 5.14 - User guides

You can search and combine Security Center events from different entities with data records imported from external sources in a single report using the Unified report investigation task.

1. On the Security Desk homepage, open the Unified report task.
2. Click Record types and select the record types you want to analyze.
   Assuming that your record types correspond to event types, such as arrests or thefts, you can check the correlation between different record types by filtering them on a common property.

   By default, you can always correlate your records using their timestamp and location properties. The timestamp and location properties are fields in your records to which your system administrator has assigned the Timestamp and Location functions. More often than not, instead of having a single Location field, use a Latitude and Longitude pair that indicates the exact location where an event occurred.

   For more information on how record types are defined in Security Center, see Creating record types.

3. To correlate your record types by timestamp, click the Event timestamp filter and specify a range of dates or times.
   This filter applies to the fields assigned to the Timestamp function in record types. To filter on other timestamp fields that aren’t assigned to the Timestamp function, you need to use the Conditions filter.
4. To correlate your record types by physical location, click the Physical location filter and select an area from the drop-down.
5. To correlate your record types by location, click the Geographical location filter and draw the regions in which data is to be found or excluded.
   1. Click Edit.
      A map window opens.
   2. Click Draw polygon () to start drawing.
      Click once for each endpoint, and click the first endpoint to close the polygon.

      
   3. If necessary, click and drag a point to adjust the shape of the polygon.
   4. If necessary, draw more regions.
   5. Click OK to save your changes.
   6. Click Switch to map mode to change the canvas to the map display.
      The regions added as the location filter are displayed in green. Only records found within these regions are returned as results.
   7. Select the Exclude regions option to exclude the records found within these regions from the results.
      The color of the regions changes to red.
   
6. To add filters on fields other than timestamp and location, click the Conditions filter.
   If two record types each have a field with the same name and data type, conditions applied to that field apply to both record types. If you add a condition for a field that doesn’t exist in some record types, that condition has no effect on those record types.
   1. Click Add an item () under the Conditions filter.
      The Condition dialog box opens.
   2. Click the record type and the field that you wish to filter.
      

      NOTE: When you select a Security Center event category as a record type, the custom fields associated to the related entity types become available as condition filter. For example, if you select Access events, the custom fields associated to door, elevator, cardholder, visitor, and credential entities are available. Note the following limitations:

      • You can’t filter by door side.
      • Image custom fields aren’t supported.
      • Encrypted custom fields aren’t supported.
      • Only the Equal to (=) operator is supported for custom fields.
   3. Select a comparison operator and a value, and then click Add.
      NOTE: Enter string values without using double quotes.

      For the In and Not in operators, enter a list of comma-separated values without adding a space after the comma, unless the space is part of the value you want to match.

      For the pattern matching operator, enter the value as a regular expression.

      • Click Pattern matching options > General for a list of the most commonly used metacharacters.
      • Click Pattern matching options > ALPR to transform a license plate number you entered into a regular expression for matching OCR-equivalent characters, such as '8' and 'B', '1' and 'I', and '0' and 'O' and 'D'.
      The condition is added to the Conditions filter.
   4. Add more conditions on the same or different fields as needed.
7. Click Generate report.
   The query results are displayed in the report pane. Right-click on any column header to add or remove columns from the report as needed.
8. Double-click a row to display it in a tile in the canvas.
   
9. If the record types are georeferenced, click Switch to map mode to display the results on the map.
10. Click a map object of a record type to open the information bubble with the details of the record.
    
11. In the information bubble, click to edit the record or to delete the record.
12. Click to close the information bubble.