Alarms and events

CoreSight separates events (things that happened — a motion hit, a detection, a face match) from alarms (things an operator must deal with). Events are the record; alarms are the workflow.

From event to alarm

Motion detection and AI analytics produce events continuously. Events that matter raise an alarm. Repeated triggers from the same camera are coalesced into one alarm rather than flooding the queue — a person walking around a lobby is one alarm, not forty.

The alarm lifecycle

Operators work the queue on the Alarms page:

Open — a new alarm, waiting for attention. Review the source camera and the triggering footage.
Acknowledge — claim it. The alarm can be assigned to a specific operator so responsibility is explicit.
Clear — resolve it once handled.

Every transition is recorded in the alarm's history — who acknowledged, when, and how it was resolved — and lands in the audit log.

Escalation

An alarm nobody acknowledges should not die quietly. Escalation policies re-raise unhandled alarms after a timeout — notifying again, or notifying a wider group — so a missed alarm at 3 a.m. climbs until someone responds.

Notification channels

Alarms and events can notify people outside the UI:

Webhook — an HTTP POST to a URL you configure; the integration point for chat tools, SMS gateways, or a central SOC.
Email — via your SMTP server.
Web push — native browser notifications on operator devices. Push is opt-in per user, per device: each operator enables it for a given browser from the notification settings, and can turn any device off independently. Notifications arrive even when the CoreSight tab is not focused.

Web push requires the browser to reach the box over HTTPS and the operator to accept the browser's notification permission prompt.

Searching events

The Events page is the searchable history: filter by camera, event type, and time range to answer questions like "all motion on the perimeter cameras last weekend" or "every plate read at the gate yesterday".

CSV export and evidence bundles

From a search result you can:

Export CSV — the matching events as a spreadsheet, for reports or handing to another system.
Export an evidence bundle — the recorded clips tied to the matching events, packaged as one downloadable archive (built in the background; see Playback and export).

Access control

Identity and plate events can drive door controllers: CoreSight maintains an allowlist (default-deny) of identities and plates, and on a match calls your HTTP-based door controller to grant access. Configure this under the access-control section if your site uses it.