Filtering and grouping alarms in Security Center - Security Center 5.6

Security Center User Guide 5.6

series
Security Center 5.6
revised_modified
2019-10-09

You can filter and group alarms to control how they appear in the Alarm monitoring task and the Monitoring task.

Procedure

To filter alarms:

  1. In the Alarm monitoring task or the Monitoring task, click the filter icon ().
    NOTE: In the Monitoring task, you must select Alarms from the Events/Alarms toggle button. The Events/Alarms toggle button only appears when you enable alarm monitoring in the Monitoring task.

    If you cannot see the Filter () or Events/Alarms toggle button, drag the top of the canvas down to expose the alarm list that appears at the top of the screen.

  2. Select or clear the following filters:
    Show all
    Display all alarms (no filter).
    Show active
    Show active alarms.
    Show under investigation
    Show alarms that are currently under investigation.
    Show acknowledgement required
    Show alarms where their source conditions are cleared but they must still be acknowledged.
    Show acknowledged
    Show acknowledged alarms.

To group alarms:

  1. In the Alarm monitoring task or the Monitoring task, right-click a column heading and select Group by.
    NOTE: In the Monitoring task, you must select Alarms from the Events/Alarms toggle button. The Events/Alarms toggle button only appears when you enable alarm monitoring in the Monitoring task. If you cannot see the Events/Alarms button, drag the top of the canvas down to expose the alarm list that appears at the top of the screen.
  2. In the Group by dialog box, select Enable grouping.
  3. From the drop-down list, select the highest level of grouping you would like to apply to the alarms.
    You can group the alarms by:
    Alarm
    Alarm entity name.
    Priority
    Alarm priority. All alarms imported from Omnicast have their priority set to 1 by default. You can change their priority at a later time in the Config Tool.
    Source
    The source entity that triggered the alarm, when the alarm is triggered by an event-to-action. It shows a username when the alarm is triggered manually.
    Source entity type
    The source entity type that triggered the alarm, when the alarm is triggered by an event-to-action. It shows User when the alarm is triggered manually.
    State
    Current state of the alarm.
    Active
    Alarm is not yet acknowledged. Selecting an active alarm shows the alarm acknowledge buttons in the report pane.
    Acknowledged (Default)
    Alarm was acknowledged using the default mode.
    Acknowledged (Alternate)
    Alarm was acknowledged using the alternate mode.
    Acknowledged (Forcibly)
    Alarm was forced to be acknowledged by an administrator.
    Under investigation
    Alarm with an acknowledgement condition that is still active was put under investigation..
    Acknowledgement required
    Alarm with an acknowledgement condition that was cleared is ready to be acknowledged.
  4. To apply additional grouping levels, select Then by.
  5. Click Advanced.
  6. To change the grouping order, select a group, and then use the and arrows.
  7. To show alarm information in the header of the group, do the following:
    1. Select a group, and then click Edit the item ().
    2. Select the alarm columns you want to show.
    3. To change the column order of appearance, use the and arrows.
    4. Click OK.
  8. Click Apply.