## Detect Incidents

##

This tool works with a time-enabled layer of points, lines, areas, or tables that represents an instant in time. Using sequentially ordered features, called tracks, this tool determines which features are incidents of interest. Incidents are determined by conditions that you specify.

First, the tool determines which features belong to a track using one or more fields. Using the time at each feature, the tracks are ordered sequentially and the incident condition is applied. Features that meet the starting incident condition are marked as an incident. You can optionally apply an ending incident condition; when the end condition is true, the feature is no longer an incident. The results will be returned with the original features—with new columns representing the incident name—and indicate which feature meets the incident condition. You can return all original features or only the features that are incidents.

For example, suppose you have GPS measurements of hurricanes every 10 minutes. Each GPS measurement records the hurricane's name, location, time of recording, and wind speed. Using these fields, you could create an incident where any measurement with a wind speed greater than 208 km/h is an incident titled `Catastrophic`. By not setting an end condition, the incident would end if the feature no longer meets the start condition (wind speed slows down to less than 208).

Using another example, suppose you were monitoring concentrations of a chemical in your local water supply using a field called `contanimateLevel`. You know that the recommended levels are less than 0.01 mg/L, and dangerous levels are above 0.03 mg/L. To detect incidents where a value above 0.03mg/L is an incident and remains an incident until contamination levels are back to normal, you create an incident using a start condition of `contanimateLevel > 0.03` and an end condition of `contanimateLevel < 0.01`. This will mark any sequence where values exceed 0.03mg/L until they return to a value less than 0.01.

## Choose layer to detect incidents from

The points, lines, areas, or tables that will be used to find incidents. The input layer must be time enabled with features that represent an instant in time, as well as have one or more fields that can be used to identify tracks.

In addition to choosing a layer from your map, you can choose Browse Layers at the bottom of the drop-down list to browse to your contents for a big data file share dataset or feature layer.

## Select one or more fields to identify tracks

The fields that represent the track identifier. You can use one field or multiple fields to represent unique values of tracks.

For example, if you were reconstructing tracks of hurricanes, you could use the hurricane name as the track field.

## Build an expression condition to signify the start of an incident

Add a condition using the expression builder to determine what an incident is. If the condition you specify is true, the feature is an incident. If you do not specify an end condition, an incident ends when the start condition is no longer true.

For example, suppose you want to be alerted when the sum of fields `concentration_1` and `concentration_2` is greater than `concentration_3`. To do this, apply a condition of `($feature["concentration_1"] + $feature["concentration_2"]) > $feature["concentration_3"])`.

## Build an expression condition to signify the end of an incident

Optionally add a condition using the expression builder to determine the end of an incident. If the end condition you specify is true, the feature is no longer an incident. If you do not specify an end condition, an incident ends when the start condition is no longer true.

For example, suppose you want to be alerted when the sum of fields `concentration_1` and `concentration_2` is greater than `concentration_3`, and you want the incident to end if `concentration_4` is less than `concentration_1`. To do this, apply a start condition of `($feature["concentration_1"] + $feature["concentration_2"]) > ($join["income"] * .20)` and an end condition of `($feature["concentration_4"] < $feature["concentration_1"])`.

## Select how you want the output represented

All output methods will append fields to the original features. There are two ways to determine which features are returned:

- Only return incidents—This method will only return the features that are incidents. Any features that are not found to be incidents will not be returned.
- Return all features—This is the default. All features in the input will be returned.

## Result layer name

This is the name of the layer that will be created in My Content and added to the map. The default name is based on the tool name and the input layer name. If the layer already exists, the tool will fail.

Using the Save result in drop-down box, you can specify the name of a folder in My Content where the result will be saved.