About events

2026-02-25Last updated

An event is a record of an activity or incident that occurred in the system. Security personnel can monitor events in real time and investigate them later. Events can also trigger automations in the system.

An event in Security Center SaaS has four attributes:
Source entity
All events originate from an entity called the event source. For example, a camera has started recording, or a cardholder attempted to access a door using a stolen credential.
Event type
Describes what happened. For example, Recording started, or Access denied: Stolen credential. For the full list, see Event types.
Note:
Not all event types are available in Security Center SaaS.
Event timestamp
Indicates when the event occurred.
Event data
The contextual information that further describes the event.

Some event types can be associated with multiple entity types. For example, the Access denied event can be associated with a cardholder, a credential, and a door or elevator, depending on where the event occurred.

You can use events in the following ways:
  • Monitor live events in Security Center SaaS.
  • View past events in reporting tasks for analysis and investigation. You can filter events by source, type, and timestamp.
  • Use events to trigger actions in the system, such as Unlock a door or Send a message. For the full list, see Action types.
    Note:
    Not all action types are available in Security Center SaaS.

    To achieve this, you can configure an automation.

System versus custom events

Security Center SaaS has predefined event types called system events. You can add new event types to your system, either by installing plugins or by defining them yourself. These are called custom events, and you can use the same way you use system events.

Live versus offline events

When the event source is a device or an external application, live events and offline events must be differentiated.
  • A live event is an event that Security Center SaaS receives when the event occurs. Security Center SaaS processes live events in real-time. Live events are displayed in the event list and can be used to trigger automations.
  • An offline event is an event that occurs while the event source is offline. Security Center SaaS only receives the offline events when the event source is back online.
Depending on how old the event is when it is received, Security Center SaaS can be configured to do one of the following:
  • Treat it as a live event, typically within a few minutes of the event occurrence.
  • Record the event in the database for reporting without sending notifications to online users: suitable for when the event is less than a predefined number of days old.
  • Discard the event without saving it to the database: suitable for when the event is more than a predefined number of days old.