{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/keep-axis-casing-and-window-tamper-events-distinct/", "item": { "id": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/", "slug": "keep-axis-casing-and-window-tamper-events-distinct", "url": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct.md", "json": "https://update.dsesecurity.com/api/v1/posts/keep-axis-casing-and-window-tamper-events-distinct/" }, "title": "Keep Axis casing and window tamper events distinct", "summary": "Preserve casing-open versus faulty-window identity, source name and state in the alert mapping. A generic tamper flag can hide which documented condition needs investigation.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "video-surveillance", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-30T06:05:03+00:00", "modified_at": "2026-10-30T06:05:13+00:00", "reviewed_on": "2026-10-30", "reading_minutes": 3, "word_count": 540, "potentially_affected": "Axis devices that expose the documented casing or front-window detection events; event availability must be checked on the actual device.", "dse_recommendation": "DSE recommends separate mapping entries for event type, source name and state before enabling an operational tamper alert.", "primary_source": { "name": "Axis Communications — Open Casing and Faulty Front Window", "url": "https://developer.axis.com/vapix/network-video/open-casing-faulty-front-window/", "published_on": null, "authority": "Axis Communications" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Keep the two event types and their reported sources separate. An alert should let an operator identify the condition and affected component before deciding what inspection is required.

\n

Source fact: documented behavior

\n

The Open Casing and Faulty Front Window describes separate events for an opened device casing and a front window that has been removed, vandalized or otherwise malfunctioned.

\n

The casing event uses an Open state, while the window event uses Faulty; each description assigns one to its active condition and zero to an inactive event.

\n

Both declarations include a Name source item for the affected device, with source examples distinguishing a camera or junction box from a housing.

\n

What the source does not establish

\n

This article defines an alert-mapping review, not a universal tamper detector or confirmation of vandalism. Check supported event declarations on the actual device. Keep a reported event, the physical inspection and any incident conclusion as separate evidence, and avoid an unsafe physical exercise merely to activate an alarm.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends separate mapping entries for event type, source name and state before enabling an operational tamper alert.

\n
    \n
  1. Retrieve the actual supported declarations through the documented event workflow and preserve the relevant source and state fields. Match each declaration to the installed camera, housing or other reported component with the equipment owner. Do not assign the example source names to every product or rename all incoming messages to a single undifferentiated tamper flag.
    2. \n
  2. Write the receiving application’s intended mapping without changing the device. Use proposed message fixtures for an active casing state, an inactive casing state and an active faulty-window state. Ask the reviewer to identify which event and component each fixture represents. Preserve unexpected names for investigation rather than silently redirecting them to a familiar camera record.
    3. \n
  3. Review the operational response with the responsible owner. Keep the initial task limited to checking the reported condition and equipment identity. Where an actual supported test is authorized, use an attended procedure suitable for that product and stop if it would expose wiring, damage seals or create an unsafe condition. Keep physical intervention separate from the consumer mapping exercise.
    4. \n
\n

Verification and evidence

\n

Proposed verification: feed the approved nonproduction fixtures through the receiving workflow and compare the resulting alert labels and retained state values. Confirm that an inactive observation is not displayed as a new active condition and that the two event types remain distinguishable in the operator record. Record actual outcomes without substituting an expected result.

\n

Have another reviewer trace each alert back to its declared source and original state. Retain sanitized message evidence and the mapping version. Mark unsupported events and untested equipment explicitly. No casing was opened, front window disturbed or live tamper event generated for this article.

\n

Official references

\n\n

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.

\n", "content_text": "Bottom line: Keep the two event types and their reported sources separate. An alert should let an operator identify the condition and affected component before deciding what inspection is required.\nSource fact: documented behavior\nThe Open Casing and Faulty Front Window describes separate events for an opened device casing and a front window that has been removed, vandalized or otherwise malfunctioned.\nThe casing event uses an Open state, while the window event uses Faulty; each description assigns one to its active condition and zero to an inactive event.\nBoth declarations include a Name source item for the affected device, with source examples distinguishing a camera or junction box from a housing.\nWhat the source does not establish\nThis article defines an alert-mapping review, not a universal tamper detector or confirmation of vandalism. Check supported event declarations on the actual device. Keep a reported event, the physical inspection and any incident conclusion as separate evidence, and avoid an unsafe physical exercise merely to activate an alarm.\nApplicability questions\n\nWhich of the two event types does the actual device expose?\nWhat source Name does each supported declaration report?\nDoes the consumer preserve both event identity and active or inactive state?\nWho can authorize a safe inspection or test arrangement?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends separate mapping entries for event type, source name and state before enabling an operational tamper alert.\n\nRetrieve the actual supported declarations through the documented event workflow and preserve the relevant source and state fields. Match each declaration to the installed camera, housing or other reported component with the equipment owner. Do not assign the example source names to every product or rename all incoming messages to a single undifferentiated tamper flag.\nWrite the receiving application’s intended mapping without changing the device. Use proposed message fixtures for an active casing state, an inactive casing state and an active faulty-window state. Ask the reviewer to identify which event and component each fixture represents. Preserve unexpected names for investigation rather than silently redirecting them to a familiar camera record.\nReview the operational response with the responsible owner. Keep the initial task limited to checking the reported condition and equipment identity. Where an actual supported test is authorized, use an attended procedure suitable for that product and stop if it would expose wiring, damage seals or create an unsafe condition. Keep physical intervention separate from the consumer mapping exercise.\n\nVerification and evidence\nProposed verification: feed the approved nonproduction fixtures through the receiving workflow and compare the resulting alert labels and retained state values. Confirm that an inactive observation is not displayed as a new active condition and that the two event types remain distinguishable in the operator record. Record actual outcomes without substituting an expected result.\nHave another reviewer trace each alert back to its declared source and original state. Retain sanitized message evidence and the mapping version. Mark unsupported events and untested equipment explicitly. No casing was opened, front window disturbed or live tamper event generated for this article.\nOfficial references\n\nOpen Casing and Faulty Front Window — Axis Communications; official VAPIX documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "content_markdown": "Bottom line: Keep the two event types and their reported sources separate. An alert should let an operator identify the condition and affected component before deciding what inspection is required.\n\n## Source fact: documented behavior\n\nThe [Open Casing and Faulty Front Window](https://developer.axis.com/vapix/network-video/open-casing-faulty-front-window/) describes separate events for an opened device casing and a front window that has been removed, vandalized or otherwise malfunctioned.\n\nThe casing event uses an Open state, while the window event uses Faulty; each description assigns one to its active condition and zero to an inactive event.\n\nBoth declarations include a Name source item for the affected device, with source examples distinguishing a camera or junction box from a housing.\n\n## What the source does not establish\n\nThis article defines an alert-mapping review, not a universal tamper detector or confirmation of vandalism. Check supported event declarations on the actual device. Keep a reported event, the physical inspection and any incident conclusion as separate evidence, and avoid an unsafe physical exercise merely to activate an alarm.\n\n## Applicability questions\n\n- Which of the two event types does the actual device expose?\n\n- What source Name does each supported declaration report?\n\n- Does the consumer preserve both event identity and active or inactive state?\n\n- Who can authorize a safe inspection or test arrangement?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends separate mapping entries for event type, source name and state before enabling an operational tamper alert.\n\n- Retrieve the actual supported declarations through the documented event workflow and preserve the relevant source and state fields. Match each declaration to the installed camera, housing or other reported component with the equipment owner. Do not assign the example source names to every product or rename all incoming messages to a single undifferentiated tamper flag.\n\n- Write the receiving application’s intended mapping without changing the device. Use proposed message fixtures for an active casing state, an inactive casing state and an active faulty-window state. Ask the reviewer to identify which event and component each fixture represents. Preserve unexpected names for investigation rather than silently redirecting them to a familiar camera record.\n\n- Review the operational response with the responsible owner. Keep the initial task limited to checking the reported condition and equipment identity. Where an actual supported test is authorized, use an attended procedure suitable for that product and stop if it would expose wiring, damage seals or create an unsafe condition. Keep physical intervention separate from the consumer mapping exercise.\n\n## Verification and evidence\n\nProposed verification: feed the approved nonproduction fixtures through the receiving workflow and compare the resulting alert labels and retained state values. Confirm that an inactive observation is not displayed as a new active condition and that the two event types remain distinguishable in the operator record. Record actual outcomes without substituting an expected result.\n\nHave another reviewer trace each alert back to its declared source and original state. Retain sanitized message evidence and the mapping version. Mark unsupported events and untested equipment explicitly. No casing was opened, front window disturbed or live tamper event generated for this article.\n\n## Official references\n\n- [Open Casing and Faulty Front Window](https://developer.axis.com/vapix/network-video/open-casing-faulty-front-window/) — Axis Communications; official VAPIX documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/", "url": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Keep Axis casing and window tamper events distinct", "item": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/#article", "identifier": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/", "url": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/", "headline": "Keep Axis casing and window tamper events distinct", "description": "Preserve casing-open versus faulty-window identity, source name and state in the alert mapping.", "abstract": "Preserve casing-open versus faulty-window identity, source name and state in the alert mapping. A generic tamper flag can hide which documented condition needs investigation.", "articleBody": "Bottom line: Keep the two event types and their reported sources separate. An alert should let an operator identify the condition and affected component before deciding what inspection is required.\nSource fact: documented behavior\nThe Open Casing and Faulty Front Window describes separate events for an opened device casing and a front window that has been removed, vandalized or otherwise malfunctioned.\nThe casing event uses an Open state, while the window event uses Faulty; each description assigns one to its active condition and zero to an inactive event.\nBoth declarations include a Name source item for the affected device, with source examples distinguishing a camera or junction box from a housing.\nWhat the source does not establish\nThis article defines an alert-mapping review, not a universal tamper detector or confirmation of vandalism. Check supported event declarations on the actual device. Keep a reported event, the physical inspection and any incident conclusion as separate evidence, and avoid an unsafe physical exercise merely to activate an alarm.\nApplicability questions\n\nWhich of the two event types does the actual device expose?\nWhat source Name does each supported declaration report?\nDoes the consumer preserve both event identity and active or inactive state?\nWho can authorize a safe inspection or test arrangement?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends separate mapping entries for event type, source name and state before enabling an operational tamper alert.\n\nRetrieve the actual supported declarations through the documented event workflow and preserve the relevant source and state fields. Match each declaration to the installed camera, housing or other reported component with the equipment owner. Do not assign the example source names to every product or rename all incoming messages to a single undifferentiated tamper flag.\nWrite the receiving application’s intended mapping without changing the device. Use proposed message fixtures for an active casing state, an inactive casing state and an active faulty-window state. Ask the reviewer to identify which event and component each fixture represents. Preserve unexpected names for investigation rather than silently redirecting them to a familiar camera record.\nReview the operational response with the responsible owner. Keep the initial task limited to checking the reported condition and equipment identity. Where an actual supported test is authorized, use an attended procedure suitable for that product and stop if it would expose wiring, damage seals or create an unsafe condition. Keep physical intervention separate from the consumer mapping exercise.\n\nVerification and evidence\nProposed verification: feed the approved nonproduction fixtures through the receiving workflow and compare the resulting alert labels and retained state values. Confirm that an inactive observation is not displayed as a new active condition and that the two event types remain distinguishable in the operator record. Record actual outcomes without substituting an expected result.\nHave another reviewer trace each alert back to its declared source and original state. Retain sanitized message evidence and the mapping version. Mark unsupported events and untested equipment explicitly. No casing was opened, front window disturbed or live tamper event generated for this article.\nOfficial references\n\nOpen Casing and Faulty Front Window — Axis Communications; official VAPIX documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "datePublished": "2026-10-30T06:05:03+00:00", "dateModified": "2026-10-30T06:05:13+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-axis-casing-and-window-tamper-events-distinct/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Axis casing and window tamper events distinct" }, "articleSection": [ "Cybersecurity", "Video Surveillance" ], "keywords": [ "Cybersecurity", "Video Surveillance", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "wordCount": 540, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Axis Communications — Open Casing and Faulty Front Window", "url": "https://developer.axis.com/vapix/network-video/open-casing-faulty-front-window/" } } ] } }