What are incident triggers? - Genetec Mission Control™ 2.10

Genetec Mission Control™ User Guide 2.10

series
Genetec Mission Control™ 2.10
revised_modified
2018-11-30

An incident trigger is a sequence of rules that are applied by the Genetec Mission Control™ Rules Engine to automatically detect and trigger incidents. The Rules Engine looks for specific combinations of events (type, time, correlation, and frequency) in the system in order to determine whether an incident must be triggered.

The incident trigger is defined by the following statements:
  • Each incident trigger characterizes one incident type (not all incident types have a trigger because not all incidents can be detected automatically by the system).
  • Each incident trigger is defined by a sequence of event qualifying rules.
  • Each event qualifying rule is defined by one or many event qualifiers.
  • Each event qualifier is defined by an event type and an event source.
  • You can add the following event correlation constraints to an event qualifying rule:
    Occurrence
    The events defined in the rule must occur n times. The occurrence of any event that qualifies, counts towards the total number of event occurrences.
    Interval
    This constraint can be applied in one of the following ways:
    • Used with the Occurrence constraint, you can define the time frame in which the n occurrences of qualified events must happen.
    • Used without the Occurrence constraint, you can define the maximum time lapse between the satisfaction of a previous rule and the satisfaction of the current rule. This is only applicable if no previous rule uses the Interval constraint. A previous rule is tied to the current rule through the Interval constraint by specifying the event that satisfied the previous rule (example: "Less than <x> seconds after <event>") . If the Interval constraint is disabled if it does not apply.
    Event filtering
    Two event correlation constraints are available:
    No other events occur at the source
    No events other than the qualifying events specified in the rule may occur at the same source during the specified time frame. For example, if the event qualifier specifies that Access denied at Door A must occur three times within 30 seconds without an occurrence of another event at the source, then the event Access granted at Door A before the 30 seconds is over, resets the occurrence counter. However, an occurrence of the event Access granted at Door B has no effect.
    These specific events can occur at the source
    No events other than the qualifying events specified in the rule and the specific ones listed here, may occur at the same source during the specified time frame.
    If the qualifying events specified in the rule are from different sources, it is the source of the last qualifying event that is considered when applying the event filters.