All chapters
Event reference
Every reading, report, alarm code and detection becomes an event described by the same five facts. Huntress maps about 250+ SIA DC-03 codes and 230+ Contact ID codes onto this vocabulary.
Domain#
What kind of situation the event is about.
| Domain | Covers |
|---|---|
| Intrusion | Burglary, motion, glass break, entry and perimeter alarms. |
| Fire | Smoke, heat, flame and fire panel events. |
| Medical | Medical and personal-emergency calls. |
| Panic | Hold-up, duress and panic alarms, including a person's panic button. |
| Access control | Doors, gates, request to exit, forced and held-open doors. |
| Environmental | Temperature, humidity, water, gas, air and other measurements and hazards. |
| System | Power, communication, tamper, battery and other health of a device or panel. |
| Automation | What Huntress itself did: a limit crossed, a schedule switching, a command issued. |
| Video | Camera analytics and detections. |
| Open / close | Arming and disarming a panel or area. |
| Person | Reports from a tracked person. |
| Unknown | A payload that could not be classified; it is stored as received. |
Nature#
What the event does to the situation. A restore cancels the alarm it follows.
| Nature | Meaning |
|---|---|
| Alarm | Something that needs attention has happened. |
| Restore | The condition has ended (a door closed, a zone restored, a value back inside its limit). |
| Trouble | A fault: a battery low, a line cut, a device failing. |
| Bypass | A zone was bypassed or unbypassed. |
| Test | A test report. |
| Status | Information that is neither an alarm nor a fault. |
| Command | A command was issued to an output. |
| Open / close | An arming or disarming. |
Severity#
| Severity | Use |
|---|---|
| Critical | Life safety or an immediate, serious threat: a panic alarm, a verified fire. |
| High | A likely real alarm: burglary, fire, a person detected. |
| Medium | Needs a look: tamper, a limit crossed, a fault. |
| Low | Minor or informational faults. |
| Info | Routine: keepalives, restores, openings and closings. |
Alarm-panel codes#
How to read the tableSIA alarm or trouble codes make the event. SIA restore codes cancel an alarm, shown as
RestoreCode→AlarmCode (BR→BA: BR restores BA). SIA other codes are bypass, test and status, with the first letter of their nature in brackets. Contact ID's nature comes from its qualifier: 1 for a new event, 3 for a restore, 6 for a previously reported one. A star marks a verified alarm: the incident is raised to confidence C5.| Event type | Domain | Severity | SIA alarm / trouble | SIA restore (→ cancels) | SIA other | Contact ID |
|---|---|---|---|---|---|---|
AccessDenied |
AccessControl | Medium | CA, CF | — | CB(B), KB(B), KU(S) | 421, 436, 461, 501, 503, 507, 514, 515 |
DoorForcedOpen |
AccessControl | High | CD | — | — | 423, 432, 434 |
DoorHeldOpen |
AccessControl | Medium | CG, CH, CK | — | — | 426, 427 |
RequestToExit |
AccessControl | Medium | — | — | — | 424, 425, 428, 433 |
ValidAccess |
AccessControl | Info | — | CC, CJ, CR, KC | CE(S), CL(S), CO(S) | 422, 435, 462 |
CODetected |
Environmental | Critical | CN | — | — | 112, 162, 394 |
FloodDetected |
Environmental | High | WA, WH | WJ→WA, WR→WA | WB(B), WU(S), WX(T) | — |
GasDetected |
Environmental | Medium | GA, GH, GS | GJ→GA, GR→GA | GB(B), GU(S), GX(T) | 151 |
HighTemp |
Environmental | Medium | — | — | — | 152, 158 |
LowTemp |
Environmental | Medium | — | — | — | 153, 159 |
ThresholdExceeded |
Environmental | Medium | EA, EH, ES, ET, NA, NH | EJ→EA, ER→EA, NJ→NA, NR→NA | EB(B), EU(S), EX(T), NB(B) | 150, 157, 161, 163, 168, 169 |
WaterFlow |
Environmental | Medium | WS | — | — | 113, 201, 204 |
WaterLeak |
Environmental | Medium | — | — | — | 154 |
FireAlarm |
Fire | Medium | FA, FG, FS | FC→FA, FJ→FA, FL→FA, FR→FA | FB(B), FU(S), FX(T) | 110, 115, 116, 118, 200, 202, 203, 604, 614 |
FireVerified |
Fire | Critical | FM, FV | — | — | — |
FlameDetected |
Fire | Critical | — | — | — | 117 |
HeatDetected |
Fire | Critical | FH | — | — | 114 |
SmokeDetected |
Fire | Critical | FK | — | — | 111 |
SprinklerActivated |
Fire | High | FQ | — | — | 205 |
BurglaryAlarm |
Intrusion | Medium | AA, AU, BA, BE, LA, LH | BC→BA, BH→BA, BJ→BA, BR→BA, LJ→LA, LR→LA | BB(B), BD(B), BU(S), BX(T), LB(B), LU(S), LX(T) | 130, 131, 133, 134, 135, 136, 138, 140, 146, 155, 374, 406, 457, 506, 509, 510, 511, 512, 513, 516, 613 |
BurglaryVerified |
Intrusion | Medium | BG, BM, BV | — | — | 139 |
ZoneFault |
Intrusion | Low | BS, BT, BZ, FT, FZ, GT, GZ, HT, HZ, LS, LT, MT, NT, PT, WT, XZ, ZA, ZH, ZS, ZT | ZJ→ZA, ZR→ZA | ZB(B), ZU(S), ZX(T) | 141, 142, 147, 156, 206, 320, 321, 322, 331, 332, 370, 371, 372, 373, 375, 376, 377, 378, 380, 381, 382, 386, 387, 388, 389, 391, 392, 393, 502, 532, 641 |
MedicalAlarm |
Medical | Medium | MA, MH, MS | MJ→MA, MR→MA | MB(B), MU(S), MX(T) | 100, 101, 102 |
ArmedAway |
OpenClose | Info | — | — | OJ(O), OS(O), OU(S) | 400, 402, 403, 407, 408, 409, 443, 450, 452, 459 |
ArmedStay |
OpenClose | Info | — | — | — | 405, 441, 442, 456 |
DisarmedByUser |
OpenClose | Info | — | — | OC(O), OG(O), OH(O), OI(O), OK(O), OP(O), OR(O) | 401, 451, 458, 463 |
FailToClose |
OpenClose | Medium | — | — | — | 453, 454 |
LateToArm |
OpenClose | Low | OT | — | OA(S), OL(S) | 404, 455, 464 |
AudiblePanic |
Panic | Critical | AB, PA, PH | PJ→PA, PR→PA | PB(B), PU(S) | 120, 123, 465, 615 |
DuressAlarm |
Panic | Medium | CQ, DA, DG, DH, DS, DT | DJ→DA, DR→DA | DB(B), DU(S), DX(T) | 121, 124, 125 |
SilentPanic |
Panic | Medium | HA, HH, HS, HV, PS | HJ→HA, HR→HA | HB(B), HU(S), HX(T) | 122, 534 |
CommFailure |
System | Low | CI, YA, YC, YF, YG, YH, YK, YM, YP, YS, YT, YW, YZ | — | YB(B), YX(T) | 347, 348, 349, 350, 351, 352, 353, 354, 355, 356, 357 |
CommRestored |
System | Info | — | YR→YA | — | — |
LowBattery |
System | Medium | — | — | — | 302, 309, 311, 342, 385 |
MainsFailure |
System | Medium | AT | — | — | 301, 310, 312, 314, 341, 345 |
MainsRestored |
System | Info | — | AR→AT | — | — |
PanelTamper |
System | Medium | CT, KA, KH, KS, KT | KJ→KA, KR→KA | — | 316, 317 |
ScheduleChanged |
System | Low | — | — | — | 306, 524, 525, 529, 530, 531, 625, 626, 631, 632 |
SelfTestFail |
System | Medium | SA, SS, ST, XA, XH, XS, XT | SR→SA, XJ→XA, XR→XA | SB(B), SU(S), XB(B), XU(S), XX(T) | 143, 300, 303, 304, 305, 307, 308, 313, 315, 330, 333, 334, 335, 336, 343, 346, 390, 504, 608 |
ZoneTamper |
System | Low | AS, JA, JH, JT, TA, TS, TT, TZ | JR→JA, TJ→TA, TR→TA | TB(B), TU(S), TX(T) | 137, 144, 145, 344, 383, 384, 505 |
CameraOnline |
Video | Medium | VL, VS, VT | VR→VL | VU(S), VX(T) | 609 |
CameraTamper |
Video | Low | CM, VI, VZ | — | — | — |
LineCross |
Video | Medium | VY | — | — | — |
MotionDetected |
Video | Medium | IA, IH, VM | IJ→IA, IR→IA | IB(B) | 132 |
UnknownEvent |
System | Info | QA, QH, QS, QT, RS, RT, UA, UH, US, UT, UZ | QJ→QA, QR→QA, UJ→UA, UR→UA | AN(S), QB(B), QU(S), QY(S), RA(S), RB(B), RN(C), RO(C), RR(S), RX(T), RY(S), UB(B), UU(S), UX(T) | 411, 412, 413, 414, 415, 416, 429, 430, 431, 466, 508, 520, 521, 522, 523, 526, 527, 528, 533, 601, 602, 603, 605, 606, 607, 611, 612, 616, 621, 622, 623, 624, 627, 628, 642, 654 |
Person events#
Reported by Pulse or any client of the Hunt API with an eventType. They are first-class event types, not panel codes.
| Event type | Domain | Nature | Severity |
|---|---|---|---|
| Movement | Person | Status | Info |
| Keepalive | Person | Status | Info |
| PanicAlarm | Panic | Alarm | Critical |