ZenMode — Operator Monitoring

ZenMode is the screen operators use during their shift to handle incoming alarms in real time. NOVA99x has already filtered false alarms before they arrive — what reaches the operator is a focused, time-ordered view of only what needs attention. Every shift starts and ends in ZenMode. Covers: Starting Your Shift, Site Ownership, Taking a Site.

ZenMode is the operator view — built for actively handling one owned site at a time. Admins use the separate Alarm Center (Admin View) to oversee the whole team across many sites at once.

Starting Your Shift

Three things must be in place before ZenMode shows anything: at least one site onboarded and Active in Configuration (ZenMode is empty without active cameras); you assigned to that site as an operator, directly or via role entities; and NOVA99x configured if your account uses it (optional, but most do — unfiltered ZenMode floods with noise). On your first entry, a short spotlight tour walks you through the timeline and event-card layout.

The Enter ZenMode button is greyed out if any of these prerequisites are not yet met. Hover over the button to see which requirement is still unresolved before starting your shift.

1. Navigate to ZenMode from the sidebar and click Start Shift. Alarms begin arriving in real time immediately.
2. The site list loads, ordered by alarm severity and age — sites with the most urgent unhandled alarms appear first.
3. Take a site by clicking its row — it locks to you so no other operator can take it. See Site Ownership below for full details.
4. The camera grid and timeline load for your taken site. Each camera feed is labeled TRUE ALARM or FALSE ALARM by NOVA99x.
5. Process alarms as they arrive. New alarms for your taken site appear automatically — no refresh needed.
6. When all alarms on the site are closed, release the site so other operators can take it.
7. Click End Shift when done. You land directly on your Alarm Center (Operator View) — your personal shift performance summary.

Online Users

The Online Users panel shows the real-time status of all operators on the team. Each operator appears with a status indicator:

• Blue — online (signed in, not currently in an active shift)
• Green — active in shift (currently in ZenMode or handling alarms)
• Red — offline

Site Ownership

Site ownership ensures only one operator processes a live site at a time. When a site is taken, it locks to that operator. Other operators see the active owner’s name and cannot take the site accidentally.

Taking a Site

1. In the ZenMode site list, click the site row.
2. The site locks to you immediately. Your name appears as the active operator.
3. All new alarms for that site arrive in your session automatically.

Releasing a Site

1. Close all open alarms, or click Release Site to hand off before finishing.
2. The site returns to the available pool. Another operator can take it immediately.

Troubleshooting Ownership

• Site stuck as taken — if an operator disconnected without releasing, an admin can force-release the site from the Operator Assignment panel. This action is logged in the audit trail.
• Cannot take a site — another operator already holds it. Their name is shown on the site row. Coordinate with them or ask an admin to reassign.
• Admin reassignment — admins can reassign operators to sites or cameras directly from the Operator Assignment panel without the operator needing to release first.

Processing Each Alarm

For each alarm, follow this review cycle:

1. Click the event card or timeline item to open the event modal.
2. Review the snapshot images, video clip, and camera metadata.
3. Confirm whether the event is real or false.
4. Take one of the following actions:Close — the event is resolved. Add a closure tag and optional description before confirming.Escalate — the event requires an external response (police, client notification, CMS forwarding). Escalate and then close.Acknowledge — you have seen the event but need more information before closing. The event remains open for follow-up.

Event Detail Modal

Opening an event card or clicking a timeline dot loads the alarm detail modal. It shows full context for the close/escalate/acknowledge decision:

• Breadcrumb navigation (Default Customer > [site] > [camera]) — shows exactly where in the customer hierarchy this event came from. Each segment is clickable.
• Video / image frame — the alarm snapshot with a timestamp overlay and camera label (e.g., Camera: 01). Use the Select Image Type dropdown to switch between pre-alarm, post-alarm, and snapshot frames.
• Continue button (orange, top-right) — acknowledges the alarm and formally assigns it to you as the handling operator. Alarms you opened but did not Continue are not counted in your ALARMS HANDLED metric.
• Download icon — saves the current snapshot or clip to your device for evidence packaging or client reporting.
• Share icon — copies a link to this alarm event. Recipients with appropriate access can open the event directly; useful for escalation briefings.
• Live camera feed — shown below the alarm snapshot; displays the camera’s current real-time feed so you can see whether the scene is still active alongside the historical snapshot that triggered the alarm.

Closing an Alarm

Every closed alarm requires a closure tag. Tags are configured by admins. Common tags include: False Alarm, Resolved, Escalated to Police, Technical Fault. An optional free-text description can be added for context the tag alone does not capture.

The closure timestamp, tag, description, and operator identity are recorded automatically and form part of the alarm’s audit trail. For sites with multiple operators in a shift, the platform tracks which operator took and closed each alarm.

Bulk Close — Close Alarms Modal

When you select a time range on the camera timeline or click CLOSE ALL ALARMS, the Close Alarms modal opens. It previews the scope of the bulk action before you commit:

• ALARMS TO BE CLOSED — count of alarms included in this bulk-close. Review this before confirming; if higher than expected, check whether your Focus Zone is wider than intended.
• LAST ALARM TIME — timestamp of the most recent alarm in the range being closed.
• NEW ALARMS — alarms that arrived after the bulk-close was initiated but before you confirmed. These are not included in the close action; they remain open for you to handle next.
• TOTAL IN ALARMS — total open alarm count for the site at the moment the modal opened. Shows how much of the queue this bulk action covers.
• CLOSE ALARM BETWEEN — the time range (start → end) of alarms being closed, derived from your Focus Zone or timeline selection.
• CAMERA — the camera (or site name for a site-level bulk close) the alarms belong to.
• TAG — the closure tag applied to every alarm in the batch. All alarms receive the same tag; select from the dropdown (same tags used for single-alarm closure).
• TEXT CLOSURE — optional free-text field for notes on the batch closure reason.
• Cancel — discards the action; all selected alarms remain open.
• Confirm — commits the bulk close; all alarms in the range are closed with the selected tag and text.

Why Processing Speed Matters

Alarm Processing Time (APT) — the time from opening an alarm to closing it — is recorded for every alarm you handle. It feeds directly into your Alarm Center (Operator View) and the admin’s Alarm Center (Admin View). ZenMode is GC Surge’s patent-pending processing engine. It groups correlated alarms from the same site into a single closeable event — 10 alarms become 1 event with 1 close action. Operators process them in parallel, not one at a time. In production at a live monitoring center: 10 alarms averaging 3 seconds each = 30 seconds sequential; ZenMode parallel scan = 6 seconds. 5x faster, measured in live deployment.Combined with NOVA99x pre-filtering, GC Surge reduced APT by 85% to 97%, enabling 40% more cameras per operator with no increase in headcount — but capturing those gains depends on maintaining a disciplined review cycle for each alarm.

Key Capabilities

• Focus Zone — a movable time window on the timeline that defines which alarms the operator is actively working. It appears as a shaded band between two vertical yellow markers on the timeline. Alarms inside the band are your current working set; alarms outside are still visible on the timeline but de-emphasised. Enable or disable it with the Focus Zone toggle in the ZenMode toolbar. Admins set the default width and position; operators can move and resize it during the shift. Narrow the zone to stay on the latest alarms; widen it to batch-close a longer backlog without losing your live feed.
• Focus Zone — pinned vs. live — the tooltip on the Focus Zone indicator shows the current state: Focus Zone Width: 1m · pinned · 3 open events. Pinned means the zone is anchored to a fixed position on the timeline and does not auto-scroll as new alarms arrive — use it when batch-closing a backlog. When not pinned, the zone follows the live cursor. The open-events count tells you how many unhandled alarms are inside the zone right now.

• True Alarms Only — one click hides all false alarm feeds, showing only cameras with confirmed real events.
• Missed alarms catch-up — if an operator logs in late, all unhandled alarms from the configured shift start time surface automatically for review.
• Batch close via timeline — select a range on the camera timeline and close all alarms in that range at once.
• Edit Camera Arrangement — customize the camera grid layout to prioritize specific cameras or sites during the shift.
• Show Closed toggle — when enabled, closed alarms appear on the timeline alongside open ones, letting you see what has already been handled in the current session without switching views. Turn it off to keep the timeline focused on open events only.
• RETURN TO LIVE — jumps the timeline cursor back to the current live position when you have scrolled back in history to review older events. Keeps the timeline anchored to incoming alarms rather than staying on a historical position.
• Focus Zone width selector — a time-window control (shown as a value such as 1m, 5m, etc.) that sets how wide the Focus Zone is on the timeline. A tooltip on the Focus Zone indicator shows the current state, for example: Focus Zone Width: 1m · pinned · 3 open events. Narrowing it keeps your attention on the very latest alarms; widening lets you batch-close older events without losing your live feed.
• TOTAL / OPEN / CLOSED counters — live session stats in the ZenMode header: TOTAL is the cumulative alarm count for the viewing period; OPEN is how many remain unhandled; CLOSED is how many have been processed and closed. These update in real time and reset when the viewing period changes.
• Unassign button — releases the current site from your ownership without ending your shift. The site returns to the unassigned queue and another operator can take it. Use this when you need to hand off a site mid-shift. Equivalent to Back To New Alarms, which takes you back to the site list to select a different site.

Display Modes

• Grid view — shows live camera feeds as tiles, each labelled TRUE / FALSE — best for active monitoring during a busy shift, because peripheral motion catches the eye. The grid auto-sizes to your screen: typically 9 (3×3) on a single monitor at standard density, up to 16 (4×4) on a 1440p+ display, and more in Multi-monitor mode. Beyond about 16 cameras peripheral attention degrades, which is where the timeline and True Alarms Only become essential.
• List view — shows one row per event (timestamp, camera, detection, classification), best for backlog cleanup, training and post-incident review where scanning dense information quickly matters. Most operators run Grid view during a shift and switch to List view for missed-alarm catch-up at the start of one.

Filters and Overlays

Click the Filter button in the ZenMode toolbar to open the filter panel. The panel groups available filters into: Detection type (Vehicle, Motion, Person); Alarm Type (All, Real, False); Custom time range; Tags; and Overlays. Filters narrow which events appear in your current view — they don’t remove events permanently and can be cleared at any time using Reset filter.

Inside ZenMode (Stage 4), filter chips narrow what you review. Detection-class and alarm-class chips apply the moment you toggle them; only the Absolute Range needs Apply.

Detection classes

• Person — limits the view to alarms where a person was detected. The model is trained for resilience: hoods, masks and partial occlusion still trigger detection as long as enough of the silhouette is visible, and confirmed night-time person detections appear here too. Night-time accuracy depends on the camera — IR-illuminated black-and-white scenes work well, very low-light colour scenes degrade. If a known-person event is missing, check the camera's exposure settings rather than the filter.
• Vehicle — limits the view to alarms where a vehicle was detected (cars, vans, SUVs, motorcycles, trucks, buses, bicycles). Accuracy is strongest on overhead and front-on shots in good daylight, weaker at oblique angles and in low light.
• Motion — limits the view to motion-only alarms. Worth checking for two reasons: tuning (a camera dumping many motion-only events usually needs masking — trees, flags, awnings) and edge cases (occasionally a real intruder isn't classified as Person and lands as Motion). For day-to-day shift work, most operators turn Motion off and focus on Person + Vehicle.

Alarm type

This is about authenticity, not urgency. Priority (how urgent an event is) is set separately by your account's classification rules — a real alarm at a residential perimeter at 3am is high priority, a real delivery van in business hours might be low.

• Real Alarms — events NOVA99x classified as likely real-world, alarm-worthy (something happened) rather than false triggers (a moving leaf, a lighting change). This is the operator’s default filter; layer priority on top if your account uses priority levels.
• False Alarms — events NOVA99x classified as likely false. This is a QA tool for supervisors and analysts, not a live operator workflow. Sample a few per week — especially on noisy cameras or after a model update — to confirm the AI is filtering correctly; if you find a real event mislabelled, mark it (via the closure-tag system) and that feedback retrains the model. During a regular shift, leave the filter on Real or All.
• None — events NOVA99x couldn't confidently call real or false: the safe-fallback bucket where confidence crossed neither threshold. Causes range from edge cases (unusual scene, partial occlusion) to brand-new cameras with limited per-site context. Handle them as if NOVA99x hadn't run: open the event, make a quick call, close with the right tag. As the model collects more closure feedback for that camera, the None rate drops sharply.

Time range

• Quick range — the active window for alarms, defaulting to Last 24 hours. Click the chip to pick Last 1h, 4h, 24h, This shift, or Last 7d. It filters the timeline and the camera grid; events outside the range are hidden until you change or reset it. Changing it does not affect your Focus Zone, which is a separate admin-configured shift window.
• Absolute Range (From / To) — a custom window set with calendar-and-time pickers down to minute precision. For incident investigation, set it slightly wider than the known incident window to catch the lead-up and aftermath, and add the camera filter so the grid doesn't dilute. Saved ranges aren't supported yet, so frequent investigators bookmark Video Search URLs instead.
• Apply — commits the Absolute Range From / To fields, which don't auto-commit as you type (you'd never want to query a half-finished date). Everything else — detection types, alarm class, overlays, tags — applies the moment you toggle it. If you edit the absolute range and forget to Apply, the filter chip shows “Pending” as a reminder.
• Reset filters — clears the filter chips only. It doesn't log you out or end your shift: your ZenMode session, shift timer, Focus Zone, camera assignments and any open alarms stay intact. To end a shift, use End Shift in the header — a separate flow that closes your session, locks in-progress alarms, and takes you to your Shift Performance Summary.

Overlays

• Heatmap — shows where alarm activity concentrates on a camera, used to find the source of noise. Branches, road traffic, flags or sun glare show as bright bands or spots in areas you don't want to monitor; once identified, apply a Mask to exclude that region. Heatmap data is collected continuously, so the overlay reflects the last few days of activity by default.
• Mask — a read-only overlay showing the camera’s current detection mask, so you can verify it. To create or edit masks, open the camera in Configuration and use Camera Settings → Detection Regions: draw a polygon over the area to ignore (a tree, a busy road, a strip of sky), save, and it applies within seconds. Most centres iterate masks alongside the Heatmap — see the hot spot, mask it, then watch alarm volume drop on that camera over the next 24 hours.
• History Mask — shows what was excluded from detection at the moment an alarm was generated, as opposed to Mask, which shows what’s excluded now. They’re often the same, but diverge if you’ve changed the mask since the event. It’s essential for incident audit and dispute resolution: when someone asks “why didn’t this alarm trigger?”, you can show the area was masked at the time, regardless of current configuration. Per-event historical mask state is retained for the whole retention window.

Privacy Mask

While viewing a camera event in ZenMode or Video Search, press M (keyboard shortcut shown as Mask [M] at the bottom of the screen) to open the Privacy Mask modal. This overlays the camera feed with an interactive mask view and provides three toggles to control what is displayed:

• Camera Mask — displays the current active detection mask as a red grid overlay on the camera feed. Any area covered by the grid is excluded from alarm detection. Use Clear to remove the mask or Save to commit changes.
• History — shows what was masked at the exact moment this alarm was generated, not what is masked now. If the mask was changed after the event, Camera Mask and History will differ. Essential for incident audit and dispute resolution: you can demonstrate what was or was not excluded from detection at alarm time, regardless of the current camera configuration. Per-event historical mask state is retained for the full retention window.
• Timed Mask — time-based masking rules that apply only during configured hours (for example, masking a street only during business hours when traffic is heavy). When toggled off, time-based rules are hidden from the overlay.

Playback controls: Live View [L] switches the preview to the live camera feed; Pause [P] freezes playback for closer inspection. The Select Image Type dropdown lets you choose the image frame type (pre-alarm, post-alarm, snapshot).

Tags, event count and refresh

• Tags — filter by the closure tags you've used before.
• Total number of events — the count of events in your current ZenMode view, after your Focus Zone, site/camera, alarm-type and detection filters. It's deliberately not the global queue (two operators on the same customer would otherwise see the same number despite handling different slices). For global queue depth, use the Alarm Center (Admin View).
• Refresh alarm — a manual refresh for the alarm stream. You rarely need it: ZenMode keeps a persistent connection and pushes new alarms within a couple of seconds of ingestion, usually before NOVA99x even finishes classifying. The control exists for the rare case where the connection drops (poor network, sleeping device);
• Camera event badge — each camera tile in the grid shows a badge with the count of open events for that camera (for example 3 Events). A badge is your signal to look at that camera; no badge means no new unhandled alarms from it in the current Focus Zone.
• Timeline event dots — the camera row on the timeline shows one dot per event. Green dots are open real alarms awaiting review. Grey dots are false alarms or already-closed events. Click any dot to jump directly to that event and open its detail view.

Working a Single Customer

Default Customer — the customer whose alarms you work during a session. For standard operators it's fixed for the session by design: switching customers mid-shift complicates audit and creates ambiguity over which session owns which alarm. Only roles granted multi-customer access (typically supervisor or central-monitoring-station level) can switch, and when they do, their current Focus Zone and filters reset so nothing leaks between customers.

Multi-Monitor

Multi-monitor opens a controllable second (or third) ZenMode window paired to your main session. The main window runs your alarm queue and timeline; the auxiliary windows show specific camera grids you assign. Because the pairing uses the same session token, closing alarms on the main window updates the auxiliaries in real time. Best practice is high-attention cameras on the main monitor and context views (overview shots, perimeter cameras) on the auxiliaries; all windows share the same Focus Zone and filter state.

ZenMode vs Video Search

• Active monitoring shift — processing incoming events in real time: ZenMode
• Post-incident investigation — finding a specific past event: Video Search
• Evidence review for escalation or client report: Video Search
• High-volume periods requiring fast triage: ZenMode
• New operator in training — learning event types: Video Search first, then ZenMode for production shifts.
• No live streaming or camera patrol: GC Surge is an alarm-driven platform — it does not provide a live CCTV view or camera patrol feed. Operators see a camera feed only when reviewing an active alarm in the Event Detail Modal (showing the camera’s current state at that moment). For general live surveillance monitoring, use GCX One.

Best Practices

• Review missed alarms at the start of every shift before switching to the live feed.
• Keep the Focus Zone narrow during high-activity periods to stay on the latest alarms.
• Use True Alarms Only when the queue is large to surface only what needs action.
• Use batch close on the timeline for older alarms instead of one at a time.
• Never leave a site taken without closing or releasing it — it blocks other operators from taking it.
• If alarms stop arriving on a site you have taken, check the site status in Configuration before assuming the site is quiet.