Suspicious Activity Reports (SARs) are how Fortress operationalizes the HSGP Information-Sharing requirement. Any staff member can submit; analysts triage; supervisors decide; fusion-center sharing is one click — and every step is on the record. The SAR page is the institutional memory the floor staff write to and the intel desk reads from.
What it does
- Captures structured SARs — type, subject (person, location, or object), narrative, attachments — through a single form that every shift can use, on any device, in under a minute.
- Routes SARs through a New → Open → Cleared / Shared lifecycle with reviewer attribution and timestamps at every transition. Nothing falls off the queue silently.
- Provides a shareable export for fusion-center or regional-intelligence-network submission, with the share itself logged as a first-class event.
- Surfaces SAR counts by type, age, and severity on the Intel Dashboard, and lets analysts pivot from a SAR to every related call, BLE event, or Threat Assessment case.
How it works
SARs live alongside the rest of the intel data model. A SAR row can be linked to a ThreatAssessmentCase, to a call record, to a BLE inmate, or to an external person of interest. The Intel Dashboard and Intel Timeline pages pull from the same row store, so the same SAR shows up in every relevant context without copy-paste.
The submission form is intentionally short and structured so that floor staff actually use it. Required fields are the minimum that make a SAR useful (type, subject, narrative); everything else — linkages, severity, sharing decisions — is added during analyst triage.
Data captured
- SAR id, type, subject, narrative, attachments
- Submitter, reviewer chain, status transitions (UTC timestamps, displayed facility-local)
- Linkages to inmates, ThreatAssessmentCases, calls, BLE tags
- External-share metadata when sent to a fusion center (destination, sender, timestamp, recipient confirmation)
- Dismissal reasons for analyst-cleared SARs
Compliance & retention
SARs are an HSGP Information-Sharing artifact. Retention follows the longer of (a) the facility’s records schedule and (b) the linked Threat Assessment retention. Threat Assessment cases automatically extend the SAR retention to match the case window, and the case id (1, 2, or 3 in the canonical model) is pinned to the SAR row. Sharing events themselves are audit-logged with sender, destination, and timestamp.
We’ve been manually faxing SAR submissions to our regional fusion center for years, which is embarrassing to admit out loud. Does your system handle the required 28 CFR Part 23 compliance documentation automatically, or is that something we’d need to configure on our end?
We’ve been manually tracking SAR submissions in a spreadsheet for two years and it’s an absolute nightmare come audit time. Does this workflow handle the fusion center submission formats automatically, or does staff still need to manually reformat before sending?
We’ve been manually faxing our SARs to the fusion center for years and it’s been a nightmare keeping track of what got sent and when. Does this workflow allow the submitting deputy to see the status of their report after it goes up the chain, or is it more of a fire-and-forget situation on their end?
We rolled out a similar workflow last year and the audit trail piece was honestly the biggest win for us — during an OIG review we could pull every touch point on a SAR in under a minute. Curious whether your fusion center integration supports bidirectional updates or if it’s still a one-way push to the state system.
We’ve been doing our SAR submissions through a clunky email chain for two years and the lack of a real audit trail has come up twice in after-action reviews. Does this workflow integrate directly with the state fusion center portal or does someone still have to manually push it over?
We’ve been struggling with our current process for getting SARs to the fusion center in anything close to a timely manner — a lot of it still runs through email chains and spreadsheets. Does this workflow handle situations where a report needs to be flagged urgent and routed differently than a standard submission, or does everything go through the same triage queue?