Detection zones and action rules
An administrator draws areas in Detection zones, then creates actions in Action rules. Zones identify parts of the picture to watch; they do not hide pixels. Use Privacy masks when an area must be concealed.
Define the area
Choose a camera in Detection zones, draw the area's boundary on the picture, name it, and save it. Check the outline against the real scene. Zone changes are sent to the detector and restored after detector restarts.
Choose a trigger and action
| Trigger | When it runs |
|---|---|
| Object detected | A selected object meets confidence and dwell requirements |
| Object left | An object leaves after the required stay |
| Occupancy | The selected number of objects is present together |
| Absence | No selected objects have been present for the specified time |
| Button | An operator presses the button in Live view |
| Recorder health | A paging fault remains open for two minutes, and when it clears |
| Something unusual | A visit differs from the site's own normal for that camera and hour |
| Camera reports | The camera itself reports motion, a line crossing, an intrusion, a person, tampering, or another event |
Something unusual compares against the last 28 days and stays quiet until the recorder has two weeks of history, so it will not fire during commissioning. It reports at most once an hour per camera and object, and every departure reaches Alarms and the morning briefing whether or not a rule sends it.
Camera reports runs on the camera's own ONVIF events. First turn on Camera's own events for the camera (see cameras). Tick the kinds the rule is about, or none for any kind. The rule runs when the camera says something began, or when a one-off event such as a line crossing happens. It does not run when something ends. Detection areas, confidence, and Who don't apply, because the camera judged the event over its own picture. EverNVR does not check the report, so a camera that mistakes headlights for a person triggers the rule anyway. Moving a PTZ camera usually makes it report motion. While a privacy mask is being calibrated or trained on a camera, that camera's reports run no rules.
A visit stays open for as long as the object is in view, and Object detected fires again at each dwell time the site's rules ask about. A rule's dwell time can be any number of seconds above zero: a rule for a two-second stay fires at two seconds, not at the five-second mark the recorder reports on its own. A vehicle that stops is treated as parked within a few seconds and its visit closes as settled, reopening when it moves again, so a parked car does not accrue hours. A person or animal standing still is a different matter: the visit stays open and keeps counting, so a loiter rule fires whether they pace or stand, and it settles only after five minutes without movement. Whatever was already in view when detection started on a camera, or when a PTZ camera arrived at a new position, is counted but opens no visit until it moves.
Objects names what a detection rule is about. The editor offers groups first: People, Vehicles (car, truck, bus, and motorcycle) and Animals (every animal the detector reports), then the detector's own classes, such as dog or bicycle. Type names separated by commas or pick them from the chips; leave the field blank for any object. A rule written with individual classes keeps working as written. A visit is named by what most of its sightings agreed on, and the detector can call one animal a cat, a dog, and a bird in turn (see object detection), so the Animals and Vehicles groups are the steadier choice when the exact class does not matter.
Where offered, scope the rule to a camera, zone, and Who: anyone, known, or unrecognized. Identity conditions depend on reviewed examples in Known objects. Where face and plate recognition is on, Who also offers someone known by face, a face nobody enrolled, a vehicle known by its plate, and an unknown license plate. For example, "Jenny in the garage" is the Garage camera, Who set to someone known by face, and Jenny.
A rule runs a list of actions, in order, up to ten. Every run is saved in the alert history whether or not the rule does anything else, so a rule with no actions is a log: start there while checking a rule's area and timing, then add what it should do. In the editor's Actions section, Add an action offers each kind; an action can be added more than once, so one rule can post to two webhooks or notify two groups of people differently. Remove takes one out.
| Action | What it does |
|---|---|
| Send notification | Emails, texts or pushes the chosen people |
| Send webhook | POSTs the trigger details to a URL, signed when a secret is set |
| Move a camera to a preset | Recalls a stored PTZ preset, within a minute of the trigger or not at all, and can send the camera back to another preset afterwards |
| Aim a camera at the trigger | Turns a PTZ camera calibrated on the site plan toward where the detected object stood, within a minute of the trigger or not at all |
| Switch a light, siren or output | Switches one of a camera's deterrence outputs on for a number of seconds, on, or off, within a minute of the trigger or not at all |
| Play a message | Plays one of the spoken messages through a camera's speaker, one to three times, within a minute of the trigger or not at all |
| Preserve footage | Holds the footage around the trigger against retention |
| Arm or disarm rules | Enables or disables other rules, for a while or until changed |
Move a camera to a preset recalls one of the camera's own presets; EverNVR never creates presets, so make them in the camera's interface first. Then return to names a preset to go back to, or Stay there; with a preset chosen, After is the wait, from 15 seconds to 30 minutes, one minute unless changed, so a camera a rule swung to the gate is back on its own view afterwards. The return happens on its own, restart or not, unless somebody drives the camera in the meantime: an operator who took the panel keeps the view they chose, and a later rule's move replaces the pending return with its own. A camera that is busy when the time comes is tried again for up to five minutes, then the return is dropped and logged. A return is a quiet move that neither pauses a patrol nor counts as somebody taking the camera over. Both the recall and the return are camera writes on History → Camera changes, as PTZ preset recalled and PTZ returned after a rule. On a camera with auto tracking, a rule's recall or aim ends a follow in progress without pausing auto tracking, so the camera can take up whatever it finds where the rule pointed it; a follow that starts there cancels the rule's pending return, and the follow's own Return to preset applies instead.
Aim a camera at the trigger needs a PTZ camera whose heading has been measured on the site plan; until one has, the action says so. Choose the Camera to aim and a Zoom: Keep the camera's zoom, or Widest, 25%, 50%, 75% or Closest. When the rule fires on a camera that has been matched to the plan, the place the object stood, the bottom middle of its box, becomes a plan point and the PTZ turns to look at it; a trigger on the aimed camera itself is centered in its own picture. A trigger with no position, such as a button or a recorder fault, and a triggering camera that is not matched, are refused and say why in the run history. Then return to works as it does for a preset. The aim is a camera write as PTZ aimed, with the plan point and the bearing it worked out.
Switch a light, siren or output needs a camera whose outputs have been found under Deterrence on its Setup tab; until one has, the action says so. Choose the Camera, one of its Outputs, and Switch it: On for a while for a number of Seconds (1 to 300, 10 unless changed), On, until switched off, or Off. "Person at night: light for thirty seconds and siren for ten" is two actions on one rule. Like a preset recall, the switch is made within a minute of the trigger or not at all. The recorder switches a timed output off on time whatever happens to it in between, and every switch is a camera write on History → Camera changes. A siren is heard by the neighbors, so give such a rule a schedule and a cooldown.
Play a message needs a camera with a speaker EverNVR can talk through (its Setup tab says so under Deterrence) and a message saved under Settings → Spoken messages; until both exist, the action says which is missing. Choose the Camera, the Message and how many Times to play it, with a second between. "Person in the driveway after dark: light for thirty seconds and 'You are on camera'" is two actions on one rule. The message is played within a minute of the trigger or not at all, and if somebody is talking on that camera at the moment, they keep the speaker and the message is skipped. Each play is a camera write on History → Camera changes with the rule's name. Like a siren, a message is heard beyond the property line; give the rule a schedule and a cooldown.
Preserve footage opens a preserved investigation in the rule's name, from Minutes before the trigger to Minutes after, one minute before and five after unless changed, and up to an hour in all. It appears on the Investigation page like any other saved investigation, where it can be reviewed, exported, or released. Runs close together on the same camera extend the same hold rather than opening another, and a trigger with no camera, such as a site-wide button or a recorder fault, holds every camera. Holds are exempt from retention, so release them when they are no longer needed; see events and investigation.
Arm or disarm rules sets the chosen Rules to Armed or Disarmed (Set them to), For a chosen time from 15 minutes to a week, or Until changed. A disarmed rule does not run; its events are still recorded. A timed change flips back on its own, even if the recorder restarts, and saving the affected rule by hand ends it early. Like a preset recall, the change is made within a minute of the trigger or not at all. The usual shapes are a button that quiets the driveway for an hour while contractors work, and an "everyone has left" rule that arms the interior rules. A rule under a timed change shows Armed until or Disarmed until with the time, and its editor says which way it was set and that saving ends the timer.
Switching a rule off by hand also drops any of its messages still waiting to be sent. A timed disarm by another rule does not: a button that notifies someone and then quiets its own rule for an hour still sends that message.
The Action rules page lists rules by camera on the left; choose one to open it beside the list, or New rule to start another. With nothing open, the page shows every rule in one table with its trigger, place, schedule, actions, runs in the last 24 hours, last run, and status. On a narrow screen the list and the open rule take turns, with All rules to go back.
Schedules, cooldowns, and delivery
Schedules use the recorder's local time. Cooldown is the minimum time between runs per camera; a cap limits runs per camera within a window. Check overnight rules against the time zone in Settings → This recorder.
For notifications, configure both the provider and recipients. See notifications. For webhooks, set a signing secret and verify the timestamp and HMAC at the receiver. Each webhook action has its own secret; a save that leaves the secret field empty keeps the saved one, and Remove the saved secret clears it. Targets cannot be the recorder itself, its own cameras, or link-local addresses.
Ask the AI agent first can hold every action of a detection rule when the agent returns a concern below the configured threshold. If the agent is unavailable, over budget, or fails to answer within two minutes, the actions run as they would have without asking. See AI security agent.
With the agent on, the Action rules page also accepts a rule as a sentence — "text me when someone I don't know is in the garage after 10pm" — and Write the rule fills the editor from it. Nothing is saved until an administrator checks the trigger, camera, zone, schedule, and actions and selects Save. Treat it as a first draft, not a finished rule.
Finally, walk through the scene and review History for rule runs and notification delivery. History → Rules lists every run; History → Notifications lists each action of the run with its outcome, labeled Email, Text, Push, Webhook, Camera preset, Camera aimed, Camera output, Camera message, Preserve footage, Arm or disarm rules, or Logged for a rule with no actions. A rule being saved is not evidence that its destination received anything.