Related Occurrences

The Related Occurrences feature allows administrators to group and link multiple incident reports that share common elements, suspects, or events. Its primary purpose is to help security and administrative teams build a comprehensive view of connected activities by creating custom tracking lists. This article is intended for OPS-COM administrators responsible for incident management and investigation.

Setup and Configuration

There is no special module configuration required to use the Related Occurrences feature, as it is a standard component of the incident management system. However, administrators must have the appropriate permissions to view and edit incidents to create and modify related lists.

Using this Feature

Administrators can link incidents by creating a named list and adding the relevant incident numbers to that group.

Creating a Related List and Linking Incidents

1. Hover over Incidents and click Search Incidents.

2. Enter the target incident number in the Occurrence# field and execute the search to open the Incident Information screen.

3. Click the 'Incidents Menu'Related select 'Search Incidents'.
   

   

   
   
4. In the Occurrence# field enter the Incident Number you wish to relate to another.
   

   

   
   
5. The Incident Information screen displays. Note: the tabstab along the top of the form,form.
   they
provide
6. a quick summary of information. 
   Under

   Click the 'Related' tab we currently see the numeral 0 indicating that there are no incidents related at this time. When you select the Related tab, the button to Track Related Occurrences will appear.
   

   button.

   
   
   

7. Click the 'Track Related Occurrences' button to display the 'Track Related Occurrences' screen. The buttons across the top allow different options to search for. The 'Add Related Occurrences' form is now available, by selecting New Related List.
   
   

   to begin creating a connection group.

   
   
8. The first

   Enter stepa isdescriptive toname in the Name andfield Create(e.g., the list. In our example, we are naming the list "Suspicious Activity March 20".20) Inand provide context in the notesNotes field,field.

   you
can
9. add a description of what

   Click the purposeSave button. A search box will now appear at the bottom of the list is. Click 'Save' to save the list name and information. The screen will refresh with a Search box now showing at the bottom.
   

   screen.

   
   

10. Enter the Currentcurrent Incidentincident Numbernumber you are workingviewing with.into Forthe thissearch examplebox weand are using16-0004. Clickclick 'Search.'Search
    

    .

    
    

11. Click 'the Add' button next to the result to add it to your new list.

12. Enter the second incident number you wish to relate into the search box and click Search.

13. Click the Add button to add this incident to the list entitled 'Suspicious Activity March 20th'.
    
    

14. Repeat the search process by entering the Incident number you would like to relate to the first incident.
    For example, Incident 16-0004 as 16-0006 and click 'Search'. Add thissecond incident to the same list.

You can return to the Track Related Occurrences screen at any time to add additional incidents to an existing list as an investigation develops.

Visual Cues and Status Indicators

• Related Tab Counter: The resultingRelated tab on the Incident Information screen features a numeral indicating exactly how many related incidents are currently linked to the open report.

• Reciprocal Linking: Once two or more incidents are added to the same list, the relationship is reciprocal. The related incident information will lookautomatically likeshow this:up Noteunder boththe 16-0004Related tab for all incidents included in that specific list.

---

Best Practices and 16-0005Considerations

• Standardize List Names: Organizations should establish a standardized naming convention for related occurrence lists (e.g., by date, location, or specific event type) to ensure they are listed.
  easily

  searchable and understood by all investigators reviewing the case.

  
  
• To see

  Provide Context: Always use the resultnotes offield thiswhen process,creating searcha oncenew againrelated forlist to briefly explain why the originalincidents Incidentare 16-0004being linked, especially if the connection is not immediately obvious from the Search Incidents menu. Note the change in the Related Tab now indicates 1 related occurrence. 
  

  

  
  
• Click on Related to see the Related Incident Information. Note: the relatedindividual incident isdescriptions.
  now listed. This information will show up on the incident information for both incidents in question.