Alarms

Alarm management allows you to enforce a workflow to review security incidents or other events of interest across your locations. An alarm is an event that requires action: it must be reviewed and closed by someone (for example, typically a Global Security Operations Center (GSOC) operator or other security person). Typical alarms include:

  • Person detected in a restricted area

  • Person detected in an area after curfew (that is, outside of allowed hours)

  • Vehicles detected in restricted region

  • Camera rotation or blur detected

Use the Rules Engine to set up an alarm and the Alarms tab to take action on alarms assigned to you and your teammates. We will take you through the entire flow here, from setting up an alarm to reviewing and closing an alarm.

How to set up an alarm

To set up an alarm, navigate to the Rules page and click on the blue plus icon to add a new rule.

Select the event that will trigger the alarm and assign it to the group responsible for responding to the alarm along with the appropriate protocol to be followed. Please note that the analytic must be set up before it can be selected as a trigger for an alarm. For a more in depth tutorial on how to set up a rule, please read here.

The rule shown above will generate the following alarm:

Note: All alarms will initially be populated with the following:

  • Status = Unassigned

  • Assignee = Unknown

How to review an Alarm

To review an alarm, navigate to the Alarms Inbox by clicking on the alarm icon in the left navigation bar.

Once you have reached the Alarms Inbox, you should be able to see all the alarms that have been assigned to your groups. For instance, if you are in the Security Group as well as the Employees Group, you will be able to see all alarms from both groups in your inbox. This inbox is a team inbox so that you and your teammates can collaborate together to close alarms as effectively and efficiently as possible.

You can filter the inbox by status (that is,Open, Unassigned, In Progress or Closed), and by time range ( All, 24h, 3 days, 7 days and 30 days), where Open refers to alarms that are either Unassigned or In Progress.

To review the alarm, simply select the alarm of interest from the list on the left. You will then be able to view all the data associated to this alarm including a video clip of the incident occurring, in addition to a LIVE view of the camera device that triggered the alarm so that you can have eyes on both the incident and the current situation.

To take charge of the alarm, click on the Assign To Me button.

This will change the Status to "In Progress" and the Assignee to your username.

It may be helpful to add a comment at the bottom indicating any further information gathered when investigating the alarm. For instance, intel gathered from reviewing the footage of the incident. Some customers have also found this feature useful as a record for why the Assignee determined this alarm should be "Marked as False".

To close the alarm, simply select "Complete" or "Mark as False".

Reopen an Alarm

Once an alarm is closed, it will not show in the Alarm Inbox list if your filter is set to the default "Show Only Open Alarms". The Status will change to Closed with the date and time of closing. If you would like to further investigate this alarm or determine that it was handled incorrectly, you can reopen the alarm by changing the filter to "Show Closed Alarms", choosing the closed alarm in question and selecting Reopen.