Core CAD Incidents

Overview#

A call comes in at 02:14: a house fire with persons reported inside. Within seconds a dispatcher has created an incident record, assigned a priority, attached the caller's location, and flagged it for multi-agency response. From that moment forward, every unit dispatched, every status update, every communication, and every command decision is anchored to the same canonical record. When the incident commander arrives on scene, they see a complete, live picture of everything that has happened so far.

The Core CAD Incidents module is the authoritative incident lifecycle engine that underpins the Argus computer-aided dispatch platform. It governs the full arc of an incident: creation, classification, multi-agency assignment, real-time status progression, and formal closure with an auditable record. Incident data is normalised across heterogeneous ingress channels, including NG9-1-1 voice calls, AML location data, TETRA radio signals, and external CAD feeds, so that dispatchers, commanders, and field responders always work from the same consistent record regardless of how the incident first arrived.

Key Features#

Canonical Incident Record: Every incident is represented as a single authoritative record regardless of how many agencies, channels, or systems are involved. All updates, assignments, and communications are attached to this record, eliminating parallel logs and version drift.
Nature Code Classification and Dynamic Priority: Incidents are classified using a configurable nature code taxonomy that drives automatic priority scoring. Priority adjusts dynamically as new information arrives, such as the addition of casualty reports or hazardous-materials flags.
Multi-Agency Incident Sharing: A single incident can be shared across fire, police, EMS, and mutual-aid agencies simultaneously. Each agency sees a role-appropriate view while all updates flow back to the shared record, supporting JESIP joint-decision-making without duplicating the record.
Real-Time Status Lifecycle: Incidents progress through a defined state machine from creation through response, on-scene, monitoring, and closure. Every state transition is timestamped and attributed to the user or system that triggered it, providing a precise operational timeline.
Geospatial Location Intelligence: Incident locations are geocoded on ingestion and stored in WGS-84, enabling map plotting, nearest-unit calculation, and jurisdiction determination against NENA-compliant GIS boundary layers. Advanced Mobile Location data from caller handsets pre-fills the location field automatically.
Incident Linking and Related-Record Association: Incidents can be linked to prior occurrences at the same address, to ongoing major incidents, or to related intelligence records. Links are surfaced to dispatchers at creation time so context is immediately available.
Comprehensive Audit Timeline: Every action taken on an incident, creation, reclassification, unit assignment, status change, annotation, and closure, is appended to an immutable chronological timeline suitable for after-action review, legal disclosure, and performance analysis.
High-Volume Concurrency: The module is designed to sustain hundreds of simultaneous incident records during mass-casualty or major-disorder events, with event coalescing and subscription management ensuring consistent performance across large operational footprints.

Use Cases#

A 911 communications centre ingests calls from multiple telephony carriers and automatically creates incident records with caller-provided location and prior-address history pre-populated, reducing the time a dispatcher spends on data entry during the critical first seconds of a call.
A regional multi-agency coordination centre shares a single major-incident record across police, fire, and ambulance services, allowing each agency to update its own operational picture while commanders at the gold level see a unified view without reconciling separate logs.
An EMS operations manager reviews closure records and SLA breach events from overnight shifts to identify patterns in response-time overruns, using the sealed incident timeline as the source for performance reporting.
A mutual-aid activation during a large-scale flooding event distributes a shared incident record to neighbouring authorities' CAD systems via standardised data exchange, giving receiving agencies the location, nature, and current status of every active incident without manual re-keying.
A post-incident debrief team reconstructs the precise decision sequence of a multi-fatality collision by replaying the immutable incident timeline, supporting both organisational learning and coroner disclosure obligations.
An integration team connects a third-party records management system to receive incident closure data automatically, using the platform's standards-based event stream to avoid manual export workflows.

Integration#

The Core CAD Incidents module exposes incident creation, update, and query capabilities through the platform's GraphQL interface, supporting both synchronous queries and real-time subscriptions for live operational dashboards. Events are published on a CloudEvents-compliant stream so that external records management systems, analytics platforms, and partner agency CAD systems can consume state changes without polling. Inbound incidents can be received from NG9-1-1 infrastructure via NENA i3-compliant SIP signalling, from TETRA radio networks via Short Data Service messages, and from partner agencies via EDXL payloads. OAuth 2.0 bearer tokens carrying organisation and role claims enforce per-agency data boundaries at every layer, ensuring that incident records are visible only to authorised personnel within their organisational scope.

Open Standards#

NENA i3 Standard (NENA-STA-010.3 / NENA-STA-021): Incidents originating from NG9-1-1 infrastructure are received as NENA i3 Emergency Incident Data Object (EIDO) payloads, and the canonical incident record conforms to the NENA-STA-021 component dataclass specification for interoperability with i3-compliant CAD and PSAP systems.
OASIS Common Alerting Protocol (CAP) 1.2): Incidents can be exported as signed CAP 1.2 XML documents, enabling distribution to public-warning networks including IPAWS Collaborative Operating Groups and European alert aggregators.
OASIS Emergency Data Exchange Language (EDXL-SitRep / EDXL-RM): Incident state vocabulary maps to the EDXL-SitRep lifecycle model, and inbound resource requests from partner agencies can be carried as EDXL-RM payloads and normalised into the canonical incident record automatically.
NIEM 6.0 (National Information Exchange Model): Closed incident records can be serialised as NIEM 6.0 JSON using the Emergency Management and NIEM Core namespaces for exchange with law-enforcement and justice systems that require NIEM-conformant payloads.
ISO 22320 (Emergency Management, Incident Command): The incident's command and agency-assignment structure aligns with ISO 22320, supporting the role and resource hierarchy expected by Incident Command System practice and JESIP multi-agency joint-decision-making protocols.
OGC EPSG:4326 (WGS-84): All incident and resource locations are stored and exchanged as WGS-84 decimal coordinates, ensuring compatibility with OGC-compliant GIS platforms and the NENA-STA-006.3 geospatial data model.
EN 17128 (Advanced Mobile Location): Caller-handset AML data conforming to EN 17128:2020 is automatically ingested to pre-populate the incident location field with a WGS-84 coordinate and horizontal accuracy value before the dispatcher answers the call.
GraphQL (June 2018 Specification): All incident queries, mutations, and live subscriptions are served through a typed GraphQL schema, giving integrators strong contracts, introspection capability, and fine-grained field selection without separate REST endpoints.
CNCF CloudEvents 1.0: State-change and timeline events emitted by the module use the CloudEvents 1.0 envelope, making them consumable by any CloudEvents-compatible subscriber including external CAD integrations, analytics pipelines, and records management systems.

Availability#

Enterprise Plan: Included
Professional Plan: Available with a maximum incident volume limit; multi-agency sharing and cross-jurisdiction federation require the Enterprise plan.

Last Reviewed: 2026-05-26