Incident Detector Processor

The Incident Detector Processor can be used to indicate that a received GeoEvent satisfies some condition and an incident should be opened. For example, assume a data stream is reporting vehicle positions and their current speed. Incident Detector could generate an incident when any of the vehicles exceed a certain rate of speed or when any enter a particular area of interest or geofence. As new updates are received from the tracked vehicle, the ongoing incident in GeoEvent Server will be updated. The incident will be closed once the vehicle resumes a safe rate of speed or leaves the geofence area.

Incident Detector is different from other processors in that the GeoEvents sent from the processor are not copies (or derivatives) of GeoEvents received by the processor. GeoEvents sent from the processor are associated with the incident GeoEvent Definition that is created when GeoEvent Server is installed.

Incident Detector uses specified attribute and spatial conditions to detect, generate new, and update ongoing incidents. Open incidents remain in an ongoing state until closed. Incidents are closed when a GeoEvent is received that satisfies the closing condition or when no GeoEvents associated with the incident are received within a specified period of time.

When configuring Incident Detector, you must specify an opening condition; a closing condition, however, is optional. If a closing condition is not specified, the processor will use a logical negation of the opening condition as an implicit closing condition.

Remarque :

For more information on spatial relationship operators and how to construct the attribute and spatial expressions used for opening and closing conditions, see Filters.

Remarque :

GeoEvents sent into Incident Detector must have a GeoEvent Definition containing a TRACK_ID. The processor uses this tagged field to associate incidents it creates with GeoEvents it receives (which in turn are associated with a discrete object, vehicle, sensor, or other item being monitored).

With Incident Detector, you must specify a name that can be used to identify incidents opened by the processor. For example, an Incident Detector Processor created to detect incidents of speeding vehicles could associate the string Speeding Vehicle with incidents it creates.

The opening and closing conditions specified for Incident Detector can be either attribute based or based on a spatial relationship with a geofence. Like a filter, if the data associated with a received GeoEvent satisfies the specified expression, Incident Detector will detect the condition and either open a new incident, update an ongoing incident, or close an incident.

The processor can be configured to set a severity level associated with incidents. The available severity levels are notification, warning, and urgent. Incidents are limited to a single severity level; the processor must be edited and the GeoEvent Service republished in order to change the severity level.

With Incident Detector, you must specify the type of incidents the processor will create:

• Point-In-Time incidents have no closing condition. They are considered instantaneous and are closed immediately after they are generated and have no incident duration.
• Cumulative incidents have both an opening and a closing condition. The time between the incident's generation and its expiry, or closing, is the incident's duration. Cumulative incidents are monitored and updated by GeoEvent Server as additional event data is received.

Each incident generated by Incident Detector has an associated geometry. The type of geometry is specified when the processor is configured. Incident Detector is typically configured to associate a point geometry with incidents it creates to model an incident as having occurred at a specific location at a specific time. However, multipoint and polyline are also supported geometry types for incidents created by the processor.

The processor will automatically close an ongoing incident if it has not received an update for that incident's TRACK_ID within a specified period of time. Specify an appropriate expiry time (in seconds) when configuring Incident Detector to define this behavior. Incidents will expire and transition to a closed state, even if GeoEvents satisfying the processor's closing condition have not been received, if an update has not been received before the timer counting down the expiry time expires. Specify a value of zero for the expiry time to disable automatic expiry for incidents created by the processor.

For more information on the Incident Detector Processor, see the Introduction to GeoEvent Server tutorial available from GeoEvent Server tutorials.