Creating Forced Actions

This page describes how to configure Forced Actions in SIWENOID v2. A Forced Action is a mandatory operator intervention that must be completed before an event in a specific category can be acknowledged. It enforces a structured, documented response to security events.

Without a Forced Action configured, an operator can acknowledge any event with a single click, leaving no record of what action was taken. With a Forced Action configured for a category, the operator is presented with a form when they attempt to acknowledge an event in that category. The operator must fill in the required fields before the acknowledgement is accepted. The completed form is saved in the event log alongside the event record.

Forced Actions are used to meet operational and compliance requirements — for example, requiring operators to record the name of the person they contacted when a fire alarm fired, or to confirm which physical area they checked in response to an intrusion alarm.

Key characteristics of Forced Actions:

• Only one Forced Action definition can be assigned to any given event category. However, a single Forced Action definition can contain multiple input fields.
• Forced Actions are category-scoped — they apply to all events belonging to the configured category, regardless of which datapoint generated the event.
• A field marked as required within a Forced Action must be filled in before the operator can complete the acknowledgement. Optional fields can be left empty.
• All operator responses entered through Forced Actions are recorded permanently in the event log and included in event log exports.

Prev ← Creating Tasks Next → Logical Containers

To access the Forced Actions configuration, open the main menu and navigate to File → Settings → Forced Actions.

The Forced Actions screen lists all currently configured Forced Action definitions. Each definition is shown with its name and enabled status. From this screen, definitions can be created, edited, enabled, disabled, and deleted.

To create a new Forced Action, click the Add button (plus icon) in the toolbar. The Forced Action editor opens with two tabs: Fields and Trigger.

Fill in the following properties on the main editor:

Name Enter a descriptive name for this Forced Action definition. The name should reflect the category or event type it applies to, for example: “Fire alarm response”, “Intrusion alarm acknowledgement”, or “Fault notification record”. The name is used internally for identification in the configuration screen.

Enable toggle Activate or deactivate this Forced Action definition. A disabled definition remains saved but will not be presented to operators when events in the assigned category occur. Use this to temporarily suspend a Forced Action without deleting its configuration — for example, during system testing or maintenance.

User assignment Select which user accounts or user groups this Forced Action applies to. This allows different Forced Action requirements to be enforced for different operator roles. For example, a senior operator may be required to provide more detailed intervention records than a basic operator.

The Fields tab defines the input form that operators will see when acknowledging an event subject to this Forced Action. Each field represents one piece of information the operator must provide.

To add a field, click the Add button within the Fields tab. For each field, configure:

Field name The label displayed to the operator for this input field. The name should clearly describe what information is being requested. Examples: “Actions taken”, “Contacted person”, “Area verified”, “Police notified”.

Field type The type of input control presented to the operator. Four types are available:

• Multiple selection — a list of predefined options where the operator can select one or more items simultaneously. Use this when multiple responses may apply at the same time (for example: “Checked area”, “Contacted guard”, “Called police”).
• Select one (Radio) — a list of predefined options where the operator must select exactly one item. Use this for mutually exclusive choices (for example: “False alarm”, “Real alarm”, “Technical fault”).
• Combobox — a dropdown list of predefined options where the operator selects one item. Functionally similar to Radio but displayed as a compact dropdown, useful when there are many options.
• Text — a free-text input field where the operator can type any response. Use this for open-ended information that cannot be covered by predefined options (for example: a description of what was found on site, or the name of the person contacted).

Required checkbox If this checkbox is ticked for a field, the operator cannot complete the acknowledgement until this field has been filled in or a selection has been made. If the checkbox is not ticked, the field is optional and the operator can leave it empty. At least one required field per Forced Action is recommended to ensure meaningful intervention records are always captured.

The Trigger tab defines which event category activates this Forced Action. When an event belonging to the configured category arrives and an operator attempts to acknowledge it, the Forced Action form is displayed automatically.

Category selection Select the event category for which this Forced Action will be required. Only events belonging to this category will trigger the mandatory intervention form. Events in other categories are not affected.

Important constraints:

• Only one Forced Action definition can be assigned to any single event category. If you attempt to assign a second Forced Action to a category that already has one, the configuration will not be accepted. If the requirements for a category are complex, add multiple fields within a single Forced Action definition rather than creating multiple definitions.
• The trigger is category-wide — it is not possible to restrict a Forced Action to a specific datapoint or subsystem within a category. If finer-grained control is needed, consider using separate event categories for different subsystems or alarm types.

After configuring all fields and the trigger category, click Save to save the Forced Action definition. The definition becomes active immediately for all operators covered by the user assignment, provided the enable toggle is on.

• Forced Actions enforce documentation of operator responses. They are particularly valuable in regulated environments (such as EN 50131 compliant security installations or fire safety regulations) where audit trails of operator actions are required.
• The completed intervention data entered by operators is stored in the event log and is included when the event log is exported to XLSX, CSV, or HTML format. This data can be used for incident reporting and compliance audits.
• If an operator closes the Forced Action form without completing all required fields, the acknowledgement is not saved and the event remains unacknowledged in the signal log.
• Test Forced Actions thoroughly after configuration by generating test events in the relevant category and verifying that the form appears correctly and that the completed data is recorded in the event log.

—

Prev ← Creating Tasks Next → Logical Containers