Even if the panel interactions are not clear for tampered sensors, there seem to be a pattern, while the qolsysgw is connected to the panel, that we can identify as tampered. However, there does not seem to be a way to identify that a sensor is currently tampered at start time (the summary we get from the panel only tells us the sensor is open).
In any case, a tampered sensor will be a sensor that is open, and has the tampered flag set to true if we are able to determine that the sensor is currently tampered (thus, not upon restart, but only during runtime and kept-alive connection).
Summary of the identified interactions
Open and Closed have two layers:
- An
Open sensor being Open through ZONE_ACTIVE is now tampered
- A tampered sensor being
Closed through ZONE_ACTIVE is no more tampered
- Receiving two
ZONE_ACTIVE for the same tampered sensor in the same second, the first Open and the second Closed, means the sensor is no more tampered, and the next ZONE_ACTIVE message indicates the current status of the sensor (whether it is currently Open or Closed)
Identified interactions
While the sensor is currently closed
Tampering
| Time |
Event type |
Event subtype |
Pertinent data |
| T1 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
| T2 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
Untampering (sensor still closed)
| Time |
Event type |
Event subtype |
Pertinent data |
| T1 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Closed", ... }, ... } |
| T2 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Closed", ... }, ... } |
Untampering (sensor now open)
| Time |
Event type |
Event subtype |
Pertinent data |
| T1 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
| T1' (same second as T1) |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Closed", ... }, ... } |
| T2 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
While the sensor is currently open
Tampering
| Time |
Event type |
Event subtype |
Pertinent data |
| T1 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
Untampering (sensor now closed)
| Time |
Event type |
Event subtype |
Pertinent data |
| T1 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
| T1' (same second as T1) |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Closed", ... }, ... } |
| T2 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Closed", ... }, ... } |
Untampering (sensor still open)
| Time |
Event type |
Event subtype |
Pertinent data |
| T1 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |
| T1' (same second as T1) |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Closed", ... }, ... } |
| T2 |
ZONE_EVENT |
ZONE_ACTIVE |
{ "zone": { "status": "Open", ... }, ... } |