Reviewing Events
Efficient event review is critical for security operations. This guide covers workflows for reviewing Anava events and making quick decisions.
Event Review Workflow
Standard Review Process
Queue Management
Events appear in the review queue when:
- Detection confidence is above threshold
- Alert is triggered
- Push notification sent
- Manual flag added
Quick Triage
Triage View
The triage view is optimized for rapid review:
┌────────────────────────────────────────────────────────────┐
│ Event Queue 12 pending │
├────────────────────────────────────────────────────────────┤
│ ┌──────────┐ 14:32:15 | Entrance-Main │
│ │ │ Profile: After Hours Security │
│ │ [thumb] │ Detection: Person (95%) - Not authorized │
│ │ │ [Verify] [Dismiss] [Investigate] │
│ └──────────┘ │
├────────────────────────────────────────────────────────────┤
│ ┌──────────┐ 14:28:03 | Gate-North │
│ │ │ Profile: Perimeter Watch │
│ │ [thumb] │ Detection: Vehicle (88%) │
│ │ │ [Verify] [Dismiss] [Investigate] │
│ └──────────┘ │
└────────────────────────────────────────────────────────────┘
Triage Actions
| Action | When to Use | Effect |
|---|---|---|
| Verify | Confirmed real event | Marks as verified, logs action |
| Dismiss | False positive | Removes from queue, optionally logs reason |
| Investigate | Needs more info | Opens detailed view |
| Escalate | Requires supervisor | Routes to escalation queue |
Keyboard Navigation
| Key | Action |
|---|---|
V | Verify current event |
D | Dismiss current event |
I | Investigate (open details) |
E | Escalate |
N | Next event |
P | Previous event |
Detailed Review
Analysis View
Open event details for full investigation:
┌─────────────────────────────────────────────────────────────┐
│ Event Analysis │
├────────────────────────────┬────────────────────────────────┤
│ │ Overview │
│ │ ├─ Time: 14:32:15 │
│ │ ├─ Camera: Entrance-Main │
│ [Full Image] │ ├─ Profile: After Hours │
│ with bounding │ ├─ Trigger: AOAS Person │
│ boxes │ └─ Confidence: 95% │
│ ├────────────────────────────────┤
│ │ AI Analysis │
│ │ "Person detected at entrance │
│ │ during after-hours period. │
│ │ Individual is not wearing │
│ │ visible badge or uniform. │
│ │ Appears to be approaching │
│ │ the door with intent to │
│ │ enter." │
├────────────────────────────┴────────────────────────────────┤
│ Objects Detected │
│ ┌──────────┐ ┌──────────────────┐ ┌─────────────────┐ │
│ │ Person │ │ Not Authorized │ │ No Badge │ │
│ │ 95% │ │ 88% │ │ 92% │ │
│ └──────────┘ └──────────────────┘ └─────────────────┘ │
├─────────────────────────────────────────────────────────────┤
│ Question Responses │
│ • Authorized personnel? No │
│ • Employee or visitor? Unknown - no badge visible │
│ • Threat assessment: Low - no concerning items visible │
│ • Description: Male, approx 30-40, dark jacket, jeans │
├─────────────────────────────────────────────────────────────┤
│ Actions │
│ [Verify Threat] [False Alarm] [Need More Info] [Escalate] │
└─────────────────────────────────────────────────────────────┘
Comparing with Context
Use context tools to make decisions:
| Tool | Description |
|---|---|
| Recent Events | See prior events from same camera |
| Similar Detections | Find similar objects across cameras |
| Timeline | View events over time period |
| Live View | Check current camera feed |
Adding Notes
Document your review:
┌─────────────────────────────────────┐
│ Add Review Note │
├─────────────────────────────────────┤
│ Classification: [Verified Threat ▼] │
│ │
│ Notes: │
│ ┌─────────────────────────────────┐ │
│ │ Confirmed unauthorized access │ │
│ │ attempt. Individual fled when │ │
│ │ TTS activated. Notified site │ │
│ │ security at 14:35. │ │
│ └─────────────────────────────────┘ │
│ │
│ Follow-up Required: [Yes ▼] │
│ Assign to: [Security Manager ▼] │
│ │
│ [Save Note] │
└─────────────────────────────────────┘
Event Classification
Classification Categories
| Category | Description | Example |
|---|---|---|
| Verified Threat | Confirmed security event | Unauthorized person |
| Verified Alert | Confirmed non-threat | Employee without badge |
| False Positive | Incorrect detection | Shadow detected as person |
| Equipment Issue | Camera/system problem | Lighting triggered motion |
| Needs Review | Requires supervisor | Ambiguous situation |
Classification Impact
Classifications help:
- Track true positive rates
- Identify tuning needs
- Document incident history
- Improve AI prompts
Response Actions
Immediate Response
| Action | How |
|---|---|
| Trigger TTS | Click "Play Announcement" |
| Alert Security | Click "Notify Team" |
| Lock Down | Trigger I/O output (if configured) |
| Start Recording | Send command to VMS |
VMS Integration
If VMS is connected:
Response Actions:
├── Start PTZ Tracking
├── Begin High-Quality Recording
├── Display on Video Wall
├── Trigger Alarm
└── Send to Mobile App
Follow-Up Actions
Create follow-up tasks:
- Assign to team member
- Set due date
- Attach event evidence
- Track resolution
Batch Review
Reviewing Multiple Events
For efficient batch processing:
-
Filter to similar events
- Same camera, time range, detection type
-
Use batch actions
- Select multiple events
- Apply same classification
-
Document once
- Add note to group
- Link related events
Batch Classifications
Select multiple events and:
| Action | Effect |
|---|---|
| Verify All | Mark all as verified |
| Dismiss All | Clear queue for false positives |
| Flag for Review | Send to supervisor queue |
Quality Metrics
Review Performance
Track your review efficiency:
| Metric | Target | Your Performance |
|---|---|---|
| Events reviewed/hour | 60+ | -- |
| Average review time | < 30 sec | -- |
| Accurate classifications | 95%+ | -- |
| Escalation rate | < 10% | -- |
Detection Accuracy
Monitor detection quality:
This Week's Stats:
├── Total Events: 1,247
├── True Positives: 892 (71.5%)
├── False Positives: 312 (25.0%)
├── Needs Tuning: 43 (3.5%)
└── Profiles Affected: Security After Hours (highest FP rate)
Escalation Workflow
When to Escalate
Escalate when:
- Confirmed threat requires response
- Classification is uncertain
- Policy violation detected
- Multiple related events
Escalation Process
Escalation Categories
| Priority | Criteria | Response Time |
|---|---|---|
| Critical | Active threat | Immediate |
| High | Confirmed intrusion | < 5 minutes |
| Medium | Policy violation | < 30 minutes |
| Low | Review needed | < 4 hours |
Reporting
Shift Reports
Generate end-of-shift reports:
Shift Summary: 2024-01-15 (Day Shift)
├── Events Reviewed: 156
├── Verified Threats: 3
├── False Positives: 12
├── Escalations: 2
├── Average Response Time: 45 sec
└── Cameras with Issues: 2 (noted)
Incident Documentation
For verified incidents:
- Complete event classification
- Add detailed notes
- Attach evidence
- Generate incident report
- Export for records
Best Practices
Efficient Review
- Use keyboard shortcuts
- Review in batches by camera/profile
- Address high-priority first
- Document as you go
Accurate Classification
- Review full context before deciding
- Check similar recent events
- Use "Needs Review" when uncertain
- Provide feedback for false positives
Consistent Documentation
- Use standard classification terms
- Include relevant details in notes
- Link related events
- Complete required fields
Troubleshooting
Queue Overwhelmed
If events are backing up:
-
Apply aggressive filters
- Focus on high-confidence only
- Review critical cameras first
-
Use batch dismiss
- Clear obvious false positives
- Document reason once
-
Tune profiles
- Increase confidence thresholds
- Adjust trigger sensitivity
Missed Events
If real events are being missed:
- Lower confidence thresholds
- Add object types to skill
- Review trigger configuration
- Check camera positioning
Related Topics
- Session Search - Finding specific events
- Dashboard Guide - Overview metrics
- Optimization - Reducing false positives