Systems and methods for secure storyline media

Abstract

Disclosed are systems and methods of a novel framework that automatically and dynamically detects security events at a location and generates curated media content based therefrom. The disclosed framework can curate, modify and / or create animated media files from the captured security footage. Animating the captured content from security cameras can offer a creative and effective way to address privacy concerns while still providing valuable security insights that are based on, but not limited to, dynamic visualization, privacy protection, analytical efficiency, legal and ethical compliance, resource management and the like. By integrating animated content into security systems, organizations can maintain effective surveillance and monitoring capabilities while addressing privacy concerns and protecting individual identities.

Description

Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025SYSTEMS AND METHODS FOR SECURE STORYLINE MEDIACROSS REFERENCE TO RELATED APPLICATION

[0001] This application claims the benefit of. and priority to, U.S. Provisional Patent Application No. 63 / 687,367 filed August 27, 2024, the entire contents of which are incorporated herein by reference.FIELD OF THE DISCLOSURE

[0002] The present disclosure is generally related to security control mechanisms, and more particularly, to a decision intelligence (Dl)-based computerized framework that automatically and dynamically detects security' events at a location and generates curated media content based therefrom.SUMMARY OF THE DISCLOSURE

[0003] Security7systems can be designed to capture images of users upon detecting events, which typically consists of high-resolution cameras strategically placed around the monitored area. These cameras, which can be Internet Protocol (IP) cameras, closed circuit television (CCTV) cameras, or other types of digital cameras, work in conjunction with various sensors. Motion detectors, door / window sensors, and glass break sensors are commonly used to identify unusual activities. When an event, such as movement or an unauthorized entry', is detected by these sensors, the system triggers the cameras to capture images or record video. The captured media is then often stored on a secure server or cloud service for future reference. Additionally, the system may send real-time alerts to security7personnel or the property7owner, enabling immediate response to potential security7breaches. This integration of cameras and sensors ensures comprehensive monitoring and enhances the security of the premises.

[0004] Capturing images of users via security cameras, especially IP cameras, raises several privacy concerns. One major issue is the potential for unauthorized access and misuse of the recorded footage, as these cameras are connected to the internet and vulnerable to hacking. This could lead to sensitive images being leaked or used maliciously. Additionally, constant surveillance may infringe on an individual’s right to privacy, making them feel monitored and uncomfortable in both public and private spaces. There are also concerns about the storage and handling of personal data, as improper data management practices could lead to breaches or unauthorized sharing of information. Furthermore, without clear and transparent policies1ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 regarding where and when surveillance occurs, individuals may be unaware they are being recorded, which raises ethical questions about consent. These privacy concerns necessitate robust security measures, clear policies, and transparent communication to balance the benefits of surveillance with the protection of individual privacy rights.

[0005] Conventional techniques of masking or blurring images captured by security cameras is often considered an inadequate solution for several reasons. First, the primary purpose of security cameras is to provide clear and identifiable footage to ensure effective monitoring and response to incidents. Masking or blurring key areas or individuals can compromise the ability' to accurately identify perpetrators, understand events, and gather actionable evidence. Second, automated masking and blurring technologies are not always reliable and may fail to consistently obscure the necessary areas, leaving some images inadequately protected and defeating the purpose of privacy measures. Additionally, the process of blurring can be resource-intensive, requiring significant computational power and storage, which might not be feasible for all security systems. Finally, once the footage is altered through masking or blurring, it cannot be easily reversed, potentially rendering the footage useless for forensic analysis or legal proceedings. These limitations make masking or blurring a less viable option compared to implementing robust access controls, encry ption, and strict data handling policies to safeguard privacy while maintaining the functionality’ of security systems.

[0006] To that end, the disclosed systems and methods provide advanced security mechanisms for event detection at a location via a security system, whereby the captured security footage can be curated into an animated media file. As discussed herein, animating the captured content from security cameras can offer a creative and effective way to address privacy concerns while still providing valuable security insights that are based on. but not limited to. dynamic visualization, privacy protection, analytical efficiency, legal and ethical compliance, resource management and the like.

[0007] According to some embodiments, instead of showing raw, identifiable footage, the captured content can be transformed into animations. This can include using avatars or simplified, abstract representations of people. This method obscures personal details while still conveying essential information about movements and interactions. Moreover, by converting real footage into animations, the identities of individuals are protected. This reduces the risk of unauthorized identification and misuse of personal data. It allows for the monitoring of activities and detection of suspicious behavior without compromising individual privacy.2ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025

[0008] According to some embodiments, animated representations can be designed to highlight key movements and interactions more clearly, making it easier for security' personnel to analyze and interpret the footage. This can improve the efficiency of monitoring and response efforts.

[0009] In some embodiments, animating content can help meet legal and ethical standards for privacy protection. It provides a balance between the need for security and the rights of individuals to maintain their privacy. This approach can be particularly beneficial in areas with strict data protection regulations. Indeed, in some embodiments, animations can be less data- intensive than high-resolution video footage, potentially reducing storage requirements and easing the computational load for processing. This makes it a more efficient solution for longterm data management.

[0010] According to some embodiments, the level of detail in animations can be adjusted according to the specific needs of the situation. For example, more detailed animations can be used in critical security' zones, while more abstract representations can suffice in less sensitive areas. Accordingly, by integrating animated content into security systems, organizations can maintain effective surveillance and monitoring capabilities while addressing privacy concerns and protecting individual identities.

[0011] According to some embodiments, a method is disclosed that automatically and dynamically detects security events at a location and generates curated media content based therefrom. In accordance with some embodiments, the present disclosure provides a non- transitory computer-readable storage medium for carrying out the above-mentioned technical steps of the framework’s functionality7. The non-transitory computer-readable storage medium has tangibly stored thereon, or tangibly encoded thereon, computer readable instructions that when executed by a device cause at least one processor to perform a method that automatically and dynamically detects security events at a location and generates curated media content based therefrom.

[0012] In accordance with one or more embodiments, a system is provided that includes one or more processors and / or computing devices configured to provide functionality in accordance with such embodiments. In accordance with one or more embodiments, functionality is embodied in steps of a method performed by' at least one computing device. In accordance with one or more embodiments, program code (or program logic) executed by a processor(s) of a computing device to implement functionality in accordance with one or more such embodiments is embodied in, by and / or on a non-transitory computer-readable medium.3ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025DESCRIPTIONS OF THE DRAWINGS

[0013] The features, and advantages of the disclosure will be apparent from the following description of embodiments as illustrated in the accompanying drawings, in which reference characters refer to the same parts throughout the various views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating principles of the disclosure:

[0014] FIG. 1 is a block diagram of an example configuration within which the systems and methods disclosed herein could be implemented according to some embodiments of the present disclosure;

[0015] FIG. 2 is a block diagram illustrating components of an exemplary system according to some embodiments of the present disclosure;

[0016] FIG. 3A illustrates an exemplary workflow according to some embodiments of the present disclosure;

[0017] FIG. 3B depicts a non-limiting example embodiment according to some embodiments the present disclosure;

[0018] FIG. 4 depicts an exemplary implementation of an architecture according to some embodiments of the present disclosure;

[0019] FIG. 5 depicts an exemplary implementation of an architecture according to some embodiments of the present disclosure; and

[0020] FIG. 6 is a block diagram illustrating a computing device showing an example of a client or server device used in various embodiments of the present disclosure.DETAILED DESCRIPTION

[0021] The present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, which form a part hereof, and which show, by way of non-limiting illustration, certain example embodiments. Subject matter may, however, be embodied in a variety of different forms and. therefore, covered or claimed subject matter is intended to be construed as not being limited to any example embodiments set forth herein; example embodiments are provided merely to be illustrative. Likewise, a reasonably broad scope for claimed or covered subject matter is intended. Among other things, for example, subject matter may be embodied as methods, devices, components, or systems. Accordingly, embodiments may. for example, take the form of hardware, software, firmware or any combination thereof4ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025(other than software per se). The following detailed description is. therefore, not intended to be taken in a limiting sense.

[0022] Throughout the specification and claims, terms may have nuanced meanings suggested or implied in context beyond an explicitly stated meaning. Likewise, the phrase “in one embodiment” as used herein does not necessarily refer to the same embodiment and the phrase “in another embodiment” as used herein does not necessarily refer to a different embodiment. It is intended, for example, that claimed subject matter include combinations of example embodiments in whole or in part.

[0023] In general, terminology may be understood at least in part from usage in context. For example, terms, such as “and”, “or”, or “and / or,” as used herein may include a variety of meanings that may depend at least in part upon the context in which such terms are used. Typically, “or” if used to associate a list, such as A, B or C, is intended to mean A, B, and C, here used in the inclusive sense, as well as A, B or C, here used in the exclusive sense. In addition, the term “one or more” as used herein, depending at least in part upon context, may be used to describe any feature, structure, or characteristic in a singular sense or may be used to describe combinations of features, structures or characteristics in a plural sense. Similarly, terms, such as “a,” “an,” or “the,” again, may be understood to convey a singular usage or to convey a plural usage, depending at least in part upon context. In addition, the term “based on” may be understood as not necessarily intended to convey an exclusive set of factors and may. instead, allow for existence of additional factors not necessarily expressly described, again, depending at least in part on context.

[0024] The present disclosure is described below with reference to block diagrams and operational illustrations of methods and devices. It is understood that each block of the block diagrams or operational illustrations, and combinations of blocks in the block diagrams or operational illustrations, can be implemented by means of analog or digital hardware and computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer to alter its function as detailed herein, a special purpose computer, ASIC, or other programmable data processing apparatus, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, implement the functions / acts specified in the block diagrams or operational block or blocks. In some alternate implementations, the functions / acts noted in the blocks can occur out of the order noted in the operational illustrations. For example, two blocks5ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functional ily / acls involved.

[0025] For the purposes of this disclosure a non-transitory computer readable medium (or computer-readable storage medium / media) stores computer data, which data can include computer program code (or computer-executable instructions) that is executable by a computer, in machine readable form. By way of example, and not limitation, a computer readable medium may include computer readable storage media, for tangible or fixed storage of data, or communication media for transient interpretation of code-containing signals. Computer readable storage media, as used herein, refers to physical or tangible storage (as opposed to signals) and includes without limitation volatile and non-volatile, removable and nonremovable media implemented in any method or technology for the tangible storage of information such as computer-readable instructions, data structures, program modules or other data. Computer readable storage media includes, but is not limited to, RAM. ROM, EPROM, EEPROM, flash memory or other solid state memory technology, optical storage, cloud storage, magnetic storage devices, or any other physical or material medium which can be used to tangibly store the desired information or data or instructions and which can be accessed by a computer or processor.

[0026] For the purposes of this disclosure the term "‘server’ should be understood to refer to a service point which provides processing, database, and communication facilities. By way of example, and not limitation, the term “server” can refer to a single, physical processor with associated communications and data storage and database facilities, or it can refer to a networked or clustered complex of processors and associated network and storage devices, as well as operating software and one or more database systems and application software that support the services provided by the server. Cloud servers are examples.

[0027] For the purposes of this disclosure a “network” should be understood to refer to a network that may couple devices so that communications may be exchanged, such as between a server and a client device or other types of devices, including between wireless devices coupled via a wireless network, for example. A network may also include mass storage, such as network attached storage (NAS), a storage area network (SAN), a content delivery network (CDN) or other forms of computer or machine-readable media, for example. A network may include the Internet, one or more local area networks (LANs), one or more wide area networks (WANs), wire-line type connections, wireless type connections, cellular or any combination6ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 thereof. Likewise, sub-networks, which may employ differing architectures or may be compliant or compatible with differing protocols, may interoperate within a larger network.

[0028] For purposes of this disclosure, a '‘wireless network” should be understood to couple client devices with a network. A wireless network may employ stand-alone ad-hoc netw orks, mesh networks, Wireless LAN (WLAN) networks, cellular networks, or the like. A wireless network may further employ a plurality of network access technologies, including Wi-Fi, Long Term Evolution (LTE), WLAN, Wireless Router mesh, or 2nd, 3rd, 4thor 5thgeneration (2G, 3G, 4G or 5G) cellular technology, mobile edge computing (MEC), Bluetooth, 802.1 Ib / g / n, or the like. Network access technologies may enable wide area coverage for devices, such as client devices with varying degrees of mobility, for example.

[0029] In short, a wireless network may include virtually any type of wireless communication mechanism by which signals may be communicated between devices, such as a client device or a computing device, between or within a netw ork, or the like.

[0030] A computing device may be capable of sending or receiving signals, such as via a wired or wireless network, or may be capable of processing or storing signals, such as in memory as physical memory states, and may, therefore, operate as a server. Thus, devices capable of operating as a server may include, as examples, dedicated rack-mounted servers, desktop computers, laptop computers, set top boxes, integrated devices combining various features, such as two or more features of the foregoing devices, or the like.

[0031] For purposes of this disclosure, a client (or user, entity, subscriber or customer) device may include a computing device capable of sending or receiving signals, such as via a wired or a wireless network. A client device may, for example, include a desktop computer or a portable device, such as a cellular telephone, a smart phone, a display pager, a radio frequency (RF) device, an infrared (IR) device a Near Field Communication (NFC) device, a Personal Digital Assistant (PDA), a handheld computer, a tablet computer, a phablet, a laptop computer, a set top box, a wearable computer, smart watch, an integrated or distributed device combining various features, such as features of the forgoing devices, or the like.

[0032] A client device may vary in terms of capabilities or features. Claimed subject matter is intended to cover a wide range of potential variations, such as a web-enabled client device or previously mentioned devices may include a high-resolution screen (HD or 4K for example), one or more physical or virtual keyboards, mass storage, one or more accelerometers, one or more gyroscopes, global positioning system (GPS) or other location-identifying type7ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 capability, or a display with a high degree of functionality, such as a touch-sensitive color 2D or 3D display, for example.

[0033] Certain embodiments and principles will be discussed in more detail with reference to the figures. With reference to FIG. 1, a system is depicted for a location 100 which includes security’ panel 102 (e g., base unit), user equipment (UE) 112 (e.g.. a client device, as mentioned above and discussed below in relation to FIG. 10), sensors 110, network 104, cloud system 106, database 108 and media engine 200. It should be understood that while system 100 is depicted as including such components, it should not be construed as limiting, as one of ordinary skill in the art would readily understand that varying numbers of smoke detectors, UEs, sensors, cloud systems, databases and networks can be utilized; however, for purposes of explanation, system 100 is discussed in relation to the example depiction in FIG. 1.

[0034] According to some embodiments, security’ panel 102 serves as the central control hub for a location’s security system, offering a range of essential functions. Users can arm and disarm the system by entering unique access codes on the keypad, allowing authorized individuals to enter or leave without triggering alarms. The panel 102 can continuously monitor various sensors 110 (discussed below) throughout the premises, including door and window contacts, motion detectors, and environmental sensors. As discussed herein, when a threat is detected, the panel 102 can activate alarms and can notify both occupants and monitoring services.

[0035] In some embodiments, panel 102 can offer zone control, enabling users to secure specific areas while leaving others accessible. Panel 102 can integrate with smart home systems, allowing remote access and control via mobile applications. Additionally, panel 102 can feature emergency buttons for quick access to first responders and may include voice commands for hands-free operation. In some embodiments, the display screen of the security panel 102 can provide real-time status updates, while indicator lights offer at-a-glance system information. In some embodiments, panel 102 can incorporate video verification capabilities and can manage access control systems for enhanced security. In some embodiments, security panel 102 can incorporate advanced features like Wi-Fi connectivity for remote control and programmability for energy efficiency.

[0036] According to some embodiments, UE 112 can be any ty pe of device, such as, but not limited to, a mobile phone, tablet, laptop, sensor, Internet of Things (loT) device, autonomous machine, and any other device equipped with a cellular or wireless or wired transceiver. In some embodiments, UE 112 can be a device associated with an individual (or set of individuals) 8ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 for which security control services are being provided. In some embodiments, UE 112 may correspond to a device of a smart home and / or security service provider entity.

[0037] In some embodiments, a peripheral device (not shown) can be connected to UE 112, and can be any ty pe of peripheral device, such as, but not limited to, a wearable device (e.g., smart watch), printer, speaker, sensor, and the like. In some embodiments, a peripheral device can be any type of device that is connectable to UE 1 12 (and / or sensor 110 and / or security panel 102) via any type of known or to be known pairing mechanism, including, but not limited to, Wi-Fi, Bluetooth™, Bluetooth Low Energy7(BLE), NFC, and the like.

[0038] According to some embodiments, sensors 110 can correspond to sensors associated with a location of system 100. In some embodiments, the sensors 110 can be, but are not limited to, temperature sensors (e.g., thermocouples, resistance temperature detectors (RTDs), thermistors, semiconductor based integrated circuits (IC), thermometers, and the like, for example), humidity sensors, cameras, glass break detectors, motion detectors, door and window contacts, heat and smoke detectors, WiFi sensors (e.g.. 802.15.4, for example), RF sensors, cellular sensors, carbon monoxide (CO) and / or carbon dioxide (CO2) detectors, PIR sensors, time-of-flight (ToF) sensors, and the like. For example, sensor 110 can be a motion sensor associated with and / or connected to security panel 102.

[0039] In some embodiments, the sensors 110 can involve an Internet of Things (loT) environment and / or be associated with devices associated with the location of system 100. such as, for example, lights, smart locks, garage doors, smart appliances (e.g., thermostat, refrigerator, television, personal assistants (e.g., Alexa®, Nest®, for example)), smart phones, smart watches or other wearables, tablets, personal computers, and the like, and some combination thereof. For example, the sensors 110 can include the sensors on UE 112 (e.g., smart phone) and / or peripheral device (e.g., a paired smart watch).

[0040] In some embodiments, network 104 can be any type of network, such as, but not limited to, a wireless network, cellular network, the Internet, and the like (as discussed above). Network 104 facilitates connectivity of the components of system 100, as illustrated in FIG. 1.

[0041] According to some embodiments, cloud system 106 may be any type of cloud operating platform and / or network based system upon which applications, operations, and / or other forms of network resources may be located. For example, system 106 may be a sendee provider and / or network provider from where services and / or applications may be accessed, sourced or executed from. For example, system 106 can represent the cloud-based architecture associated with a security control system provider, which has associated network resources hosted on the9ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 internet or private network (e.g., network 104), which enables (via engine 200) the location management discussed herein.

[0042] In some embodiments, cloud system 106 may include a server(s) and / or a database of information which is accessible over network 104. In some embodiments, a database 108 of cloud system 106 may store a dataset of data and metadata associated with local and / or network information related to a user(s) of UE 112 / security panel 102 and the UE 112 / security panel 102, sensors 110, and the services and applications provided by cloud system 106 and / or media engine 200.

[0043] In some embodiments, for example, cloud system 106 can provide a private / proprietary management platform, whereby engine 200. discussed infra, corresponds to the novel functionality system 106 enables, hosts and provides to a network 104 and other devices / platforms operating thereon.

[0044] Turning to FIG. 4 and FIG. 5, in some embodiments, the exemplary computer-based systems / platforms. the exemplary computer-based devices, and / or the exemplary computer- based components of the present disclosure may be specifically configured to operate in a cloud computing / architecture 106 such as, but not limiting to: infrastructure a service (laaS) 510, platform as a service (PaaS) 508. and / or software as a service (SaaS) 506 using a web browser, mobile app, thin client, terminal emulator or other endpoint 504. FIG. 4 and FIG. 5 illustrate schematics of non-limiting implementations of the cloud computing / architecture(s) in which the exemplary computer-based systems for administrative customizations and control of network-hosted APIs of the present disclosure may be specifically configured to operate.

[0045] Turning back to FIG. , according to some embodiments, database 108 may correspond to a data storage for a platform (e.g., a network hosted platform, such as cloud system 106, as discussed supra), a plurality of platforms, and / or security panel 102, UE 1 12 and / or sensors 110. Database 108 may receive storage instruct! ons / requests from, for example, engine 200 (and associated microservices), which may be in any type of known or to be known format, such as, for example, standard query’ language (SQL). According to some embodiments, database 108 may correspond to any type of known or to be known storage, for example, a memory or memory’ stack of a device, a distributed ledger of a distributed network (e.g., blockchain, for example), a look-up table (LUT), and / or any other type of secure data repository.

[0046] Media engine 200. as discussed above and further below’ in more detail, can include components for the disclosed functionality. According to some embodiments, media engine10ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025200 may be a special purpose machine or processor, and can be hosted by a device on network 104, within cloud system 106, on UE 112, and / or security panel 102 (and / or on sensors 1 10). In some embodiments, engine 200 may be hosted by a server and / or set of servers associated with cloud system 106.

[0047] According to some embodiments, as discussed in more detail below, media engine 200 may be configured to implement and / or control a plurality of services and / or microservices, where each of the plurality of services / microservices are configured to execute a plurality of workflows associated with performing the disclosed location (e.g., security) management. Non-limiting embodiments of such workflows are provided below.

[0048] According to some embodiments, as discussed above, media engine 200 may function as an application provided by cloud system 106. In some embodiments, engine 200 may function as an application installed on a server(s), network location and / or other type of network resource associated with system 106. In some embodiments, engine 200 may function as an application installed and / or executing on UE 112 and / or security panel 102. In some embodiments, such application may be a web-based application accessed by UE 112, security panel 102 and / or devices associated with sensors 110 over network 104 from cloud system 106. In some embodiments, engine 200 may be configured and / or installed as an augmenting script, program or application (e.g., a plug-in or extension) to another application or program provided by cloud system 106 and / or executing on UE 112. sensors 110 and / or security panel 102.

[0049] As illustrated in FIG. 2, according to some embodiments, media engine 200 includes identification module 202, analysis module 204, determination module 206 and output module 208. It should be understood that the engine(s) and modules discussed herein are non- exhaustive. as additional or fewer engines and / or modules (or sub-modules) may be applicable to the embodiments of the systems and methods discussed. More detail of the operations, configurations and functionalities of engine 200 and each of its modules, and their role within embodiments of the present disclosure will be discussed below.

[0050] Turning to FIG. 3A, Process 300 provides non-limiting example embodiments of the disclosed framework that provides features, capabilities and / or functionality for enhanced and / or improved customization and integration of security controls for security systems at locations (e.g., home, office, building, and the like).

[0051] According to some embodiments, Steps 302, 304, 308 and 314 can be performed by identification module 202 of media engine 200; Step 310 can be performed by analysis module11ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025204; Step 312 can be performed by determination module 206; and Steps 306 and 316-320 can be performed by output module 208.

[0052] According to some embodiments, Process 300 begins with Step 302 where engine 200 can operate to monitor activity at / within a location. According to some embodiments, such monitoring can correspond to tracking users’ movements around a location. In some embodiments, such tracking may only correspond to tracking unknown (or non-resident) users, which can be performed via a variety of know mechanisms (e.g., using computer vision, for example, to perform facial recognition of the user from captured imagery', detecting the user’s device being within the perimeter of the location, and the like, for example).

[0053] Accordingly, in Step 302, engine 200 can monitor the location for a triggered sensor - for example, movement and / or presence activity of a user at the location, a glass break, door opened, and the like, which can be triggered upon the security system at the location being armed. For example, a person is detected w alking in the living room of the home, triggering the motion sensor in the living room when the security system is armed and the residents are not home. The location, as discussed herein, can be any type of known or to be known structure for which a security system can be used to secure its premises (e.g., home, office, garage, and the like).

[0054] According to some embodiments, such monitoring can occur according to, but not limited to, periodically, continuously, a criteria, a detected event, request, and the like, or some combination thereof. In some embodiments, such criteria can correspond to, but is not limited to, measurements, a time period, date, user identity (ID), threshold values (e.g., measurements meet or satisfy a threshold - for example, a movement at or below a threshold distance and / or rate (e.g., velocity), for example), mode / settings on the security panel 102 and / or sensors 110. movements of a user, and the like, or some combination thereof.

[0055] In Step 304, engine 200 can detect an event (and event information) at the location. The event can correspond to a “tripped” security sensor (sensor 110) at the location. For example, a window or door contact was triggered (e.g., via the window or door being opened when the security system was in an armed state of “stay” or “away,” for example). According to some embodiments, the detected event can have associated information, which can be identified, retrieved, determined, derived or otherwise collected, which can include, but is not limited to, a timestamp, sensor type, position in the location, environmental data, visual evidence, system logs, access logs, sensor status, and the like.12ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025

[0056] By way of example, in some embodiments, when a sensor is tripped at a location during a security event, a variety of data can be collected to help understand and respond to the situation. Firstly, the exact time and date of the event can be recorded, providing a precise timestamp of when the incident occurred. The type of sensor that was triggered whether it’s a motion detector, door / window contact sensor, glass break sensor, or another type gives insight into the nature of the disturbance. Additionally, the specific position within the location’s premises where the sensor was activated is logged, offering crucial information about the point of entry or area of activity.

[0057] In some embodiments, environmental data such as temperature, light levels, or sound intensity can also be collected if the sensors are equipped to measure these parameters. This information can help in assessing the context of the event, such as detecting a potential fire or unauthorized entry during nighttime. Video or photographic evidence from surveillance cameras linked to the sensor system can provide visual confirmation and identification of individuals involved, adding a layer of verification and aiding in subsequent investigations.

[0058] In some embodiments, details of any simultaneous alarms or alerts triggered by other sensors in the network can be gathered, giving a broader picture of the event’s scale and progression. The response time and actions taken by the security personnel or automated systems, like locking doors or alerting authorities, are documented to evaluate the effectiveness and efficiency of the security protocols in place. Collectively, this comprehensive data helps in understanding the incident, improving security measures, and preventing future occurrences.

[0059] In some embodiments, such detected / collected data can be stored locally - that is, at the location in association with the security panel 102, UE 112 and / or sensors 110. In some embodiments, such storage can be performed also and / or alternatively in database 108.

[0060] In some embodiments, upon detection of the event, engine 200 can cause an alarm to be triggered, as in Step 306. Such alarm can involve a siren being output at the location, and / or a notification being sent to, but not limited to, first responders, municipalities, a user, a mobile application, the service provider of the security system, and the like.

[0061] In Step 308, upon detection of the event in Step 304, engine 200 can collect, for a period of time, additional data. In some embodiments, the collection of additional data can occur via the sensor(s) that detected the event in Step 304, and / or other sensors related to such sensor. For example, if the door contact sensor to the living room was tripped, the additional sensor data can be collected by a motion sensor in that room and / or the camera positioned in the home that captures the activity in that room.13ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025

[0062] Accordingly, in some embodiments. Step 308’s additional data capture can correspond to security camera footage that corresponds to the activity occurring in / around the location that relates to the detected event. In some embodiments, such additional data capture can be performed for a period of time, which can be a predetermined period of time (e.g., 30 seconds, for example), and / or upon the activity being detected by the sensor(s) capturing the additional data no longer detects any activity. For example, once a security camera no longer capturing footage of activity in its covered area, operation of Step 308 can conclude.

[0063] In some embodiments, such collected additional data may also include similar types of information collected in Step 304, as discussed above. For example, such collected data (from Step 308) and, similarly information collected in Step 304, discussed supra, can be any type of information, including, but not limited to, data, metadata, text, images, video, multimedia, artificial intelligence (Al) generated information, and the like, or some combination thereof.

[0064] In some embodiments, such collected data can be stored locally - that is, at the location in association with the security panel 102. UE 112 and / or sensors 110. In some embodiments, such storage can be performed also and / or alternatively in database 108.

[0065] In Step 310, engine 200 can analyze the collected information and data from Steps 304 and 308. Step 310's analysis can involve engine 200 performing a computational analysis on the collected information / data by engine 200 implementing / executing any type of known or to be known computational analysis technique, algorithm, mechanism or technology.

[0066] In some embodiments, engine 200 may include a specific trained artificial intelligence / machine learning model (AI / ML), a particular machine learning model architecture, a particular machine learning model type (e.g., convolutional neural network (CNN), recurrent neural network (RNN), autoencoder, support vector machine (SVM), and the like), or any other suitable definition of a machine learning model or any suitable combination thereof.

[0067] In some embodiments, engine 200 may be configured to utilize one or more AI / ML techniques chosen from, but not limited to, computer vision, feature vector analysis, decision trees, boosting, support-vector machines, neural networks, nearest neighbor algorithms, Naive Bayes, bagging, random forests, logistic regression, and the like. By way of a non-limiting example, engine 200 can implement an XGBoost algorithm for regression and / or classification to analyze the collected data, as discussed herein.

[0068] According to some embodiments and. optionally, in combination of any embodiment described above or below, a neural network technique may be one of, without limitation, feedforward neural network, radial basis function network, recurrent neural network, 14ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 convolutional network (e.g., U-net) or other suitable network. In some embodiments and. optionally, in combination of any embodiment described above or below, an implementation of Neural Network may be executed as follows: a. define N eural N et work architecture / model , b. transfer the input data to the neural network model, c. train the model incrementally, d. determine the accuracy for a specific number of timesteps, e. apply the trained model to process the newly -received input data, f. optionally and in parallel, continue to train the trained model with a predetermined periodicity.

[0069] In some embodiments and, optionally, in combination of any embodiment described above or below, the trained neural network model may specify a neural network by at least a neural network topology, a series of activation functions, and connection weights. For example, the topology of a neural network may include a configuration of nodes of the neural network and connections between such nodes. In some embodiments and, optionally, in combination of any embodiment described above or below, the trained neural network model may also be specified to include other parameters, including but not limited to, bias values / functions and / or aggregation functions. For example, an activation function of a node may be a step function, sine function, continuous or piecewise linear function, sigmoid function, hyperbolic tangent function, or other type of mathematical function that represents a threshold at which the node is activated. In some embodiments and, optionally, in combination of any embodiment described above or below, the aggregation function may be a mathematical function that combines (e.g.. sum. product, and the like) input signals to the node. In some embodiments and. optionally, in combination of any embodiment described above or below, an output of the aggregation function may be used as input to the activation function. In some embodiments and, optionally, in combination of any embodiment described above or below, the bias may be a constant value or function that may be used by the aggregation function and / or the activation function to make the node more or less likely to be activated.

[0070] In Step 312, based on the analysis in Step 308, engine 200 can determine a sequence of events, which can be configured as a data structure, file, object, item., and the like. For example, a sequence of events, which can begin with the detected event (from Step 304), and additionally, temporally organized events that followed the detected event can be compiled into a media file that merges the captured footage of each corresponding event. For example, upon a door contact15ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 being triggered in the home (e.g., in Step 304). engine 200 can compile a media file that provides the captured security footage of the intruder entering the living room, then moving to the kitchen, then exiting the back door, and eventually leaving by walking down the driveway, which all can be captured by a series of cameras at the location and organized to provide a storyline of the intruder’s activities at the location.

[0071] In some embodiments, the determined output from Step 308 (e.g., data structure, file, and the like) can be stored in database 108, as discussed above. In some embodiments, such storage can occur locally in association with the security panel 102, UE 112 and / or sensors 110.

[0072] In some embodiments, processing of Process 300 can proceed to Step 316 based on a received request for footage of a security event. Such request can include information related to, but not limited to, a user, ty pe of user, time, time period, type of event, particular actions in an event, and the like, or some combination thereof. In some embodiments, the determined output from Step 308 may be subject to the analytical conversions and modifications discussed below as part of the workflow for securely storing captured footage to address certain privacy and regulatory concerns, as discussed above.

[0073] In Step 316, engine 200 can create a storyline animation media file. In some embodiments, the digital content of the determined sequence of events (from Step 312) can be curated as a new or modified media file that involves the content being regenerated as animated content. According to some embodiments, a storyline corresponds to the determined sequence of events, such that the animated media file comprises a visual and digital representation of the events that originated from and followed the detected event. In some embodiments, the story line animation media file is an aggregate of the sequence events in an original format (e.g. nonanimated). In some embodiments, certain portions of events and / or certain events may’ be animated, while others remain non-animated (e.g., animations of the frames with a person depicted, for example).

[0074] According to some embodiments, such conversion can involve extracting key frames from the file (from Step 314), and inputting such key frames (and related embeddings, for example) into a video editing model (e.g., any of the above AI / ML models discussed above - for example, Runway ML, DeepArt, Synthesia, Adobe Sensei™, and other known or to be known AI / ML models that can convert digital content to animated content, as discussed herein). Thus, the analysis of such model can involve edits, enhancements and / or added / removed effects, and the like, that can create a secure, private animated media file of the sequence of events.16ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025

[0075] In some embodiments, upon performing the animation creation in Step 316 based on the request (from Step 314), engine 200 can perform a search of the stored sequence of events files (from Step 312). For example, the request can indicate event information and / or a time period, whereby upon searching for an identifying a first instance of the requested information, engine 200 can traverse the storage location to identify corresponding events that are related thereto (e.g., that are part of the sequence). In some embodiments, such traversal and identification of corresponding events can be performed in reverse temporal order, within the confines of a time period. For example, the time period is 5 minute period, therefore, events from X+5, X+4. .. .X+l and X can be collected, in such order, for example.

[0076] In Step 318, engine 200 can store the animated media file that was created in Step 316. In some embodiments, such storage can be stored locally - that is, at the location in association with the security' panel 102, UE 112 and / or sensors 110. In some embodiments, such storage can be performed also and / or alternatively stored in database 108.

[0077] And, in Step 320, engine 200 can cause the rendering of the storyline animation. Such rendering can be, but is not limited to, in response to a request (e.g., request from Step 314), upon the detection of the event (from Step 304) and / or triggering of the alarm (e.g., Step 306), and the like. In some embodiments, the rendering can involve communication of an electronic message and / or notification to a device (e.g.. UE and / or base unit) with a display, and / or an application running on such devices, for the rendering and view of such animated footage.

[0078] Turning to FIG. 3B, depicted is a non-limiting example embodiments of a sequence of events 350 detected by a security' system at a location (e.g., home). The example sequence 350 includes first event 352, second event 354, third event 356 and forth (final) event 358. As discussed above, the captured clips for each event 352-258 can be compiled into a media file so that they are rendered in order of their occurrence, which can be streamed without interruption and / or with transitions between each event to indicate a different time for each event (e.g., entered house, then entered the kitchen, and then 3 minutes later, left the house via the point of entry).

[0079] FIG. 6 is a schematic diagram illustrating a client device showing an example embodiment of a client device that may be used within the present disclosure. Client device 600 may include many more or less components than those shown in FIG. 6. However, the components shown are sufficient to disclose an illustrative embodiment for implementing the present disclosure. Client device 600 may represent, for example, UE 112 discussed above at least in relation to FIG. 1.17ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025

[0080] As shown in the figure, in some embodiments, Client device 600 includes a processing unit (CPU) 622 in communication with a mass memory 630 via a bus 624. Client device 600 also includes a power supply 626, one or more network interfaces 650, an audio interface 652, a display 654, a keypad 656, an illuminator 658, an input / output interface 660, ahaptic interface 662, an optional global positioning systems (GPS) receiver 664 and a camera(s) or other optical, thermal or electromagnetic sensors 666. Device 600 can include one camera / sensor 666, or a plurality of cameras / sensors 666, as understood by those of skill in the art. Power supply 626 provides power to Client device 600.

[0081] Client device 600 may optionally communicate with a base station (not shown), or directly with another computing device. In some embodiments, network interface 650 is sometimes known as a transceiver, transceiving device, or netw ork interface card (NIC).

[0082] Audio interface 652 is arranged to produce and receive audio signals such as the sound of a human voice in some embodiments. Display 654 may be a liquid crystal display (LCD), gas plasma, light emitting diode (LED), or any other type of display used with a computing device. Display 654 may also include a touch sensitive screen arranged to receive input from an object such as a stylus or a digit from a human hand.

[0083] Keypad 656 may include any input device arranged to receive input from a user. Illuminator 658 may provide a status indication and / or provide light.

[0084] Client device 600 also includes input / output interface 660 for communicating with external. Input / output interface 660 can utilize one or more communication technologies, such as USB, infrared, Bluetooth™, or the like in some embodiments. Haptic interface 662 is arranged to provide tactile feedback to a user of the client device.

[0085] Optional GPS transceiver 664 can determine the physical coordinates of Client device 600 on the surface of the Earth, which typically outputs a location as latitude and longitude values. GPS transceiver 664 can also employ other geo-positioning mechanisms, including, but not limited to, triangulation, assisted GPS (AGPS), E-OTD. CI, SAI, ETA, BSS or the like, to further determine the physical location of client device 600 on the surface of the Earth. In one embodiment, however, Client device 600 may through other components, provide other information that may be employed to determine a physical location of the device, including for example, a MAC address, Internet Protocol (IP) address, or the like.

[0086] Mass memory 630 includes a RAM 632, a ROM 634, and other storage means. Mass memory 630 illustrates another example of computer storage media for storage of information such as computer readable instructions, data structures, program modules or other data. Mass18ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 memory 630 stores a basic input / output system (' BIOS’ ) 640 for controlling low-level operation of Client device 600. The mass memory also stores an operating system 641 for controlling the operation of Client device 600.

[0087] Memory' 630 further includes one or more data stores, which can be utilized by Client device 600 to store, among other things, applications 642 and / or other information or data. For example, data stores may be employed to store information that describes various capabilities of Client device 600. The information may then be provided to another device based on any of a variety of events, including being sent as part of a header (e.g., index file of the HLS stream) during a communication, sent upon request, or the like. At least a portion of the capability information may also be stored on a disk drive or other storage medium (not shown) within Client device 600.

[0088] Applications 642 may include computer executable instructions which, when executed by Client device 600, transmit, receive, and / or otherwise process audio, video, images, and enable telecommunication with a server and / or another user of another client device. Applications 642 may further include a client that is configured to send, to receive, and / or to otherwise process gaming, goods / services and / or other forms of data, messages and content hosted and provided by the platform associated with engine 200 and its affiliates.

[0089] As used herein, the terms “computer engine" and "engine" identify at least one software component and / or a combination of at least one software component and at least one hardware component which are designed / programmed / configured to manage / control other software and / or hardware components (such as the libraries, software development kits (SDKs), objects, and the like).

[0090] Examples of hardware elements may include processors, microprocessors, circuits, circuit elements (e g., transistors, resistors, capacitors, inductors, and so forth), integrated circuits, application specific integrated circuits (ASIC), programmable logic devices (PLD), digital signal processors (DSP), field programmable gate array (FPGA), logic gates, registers, semiconductor device, chips, microchips, chip sets, and so forth. In some embodiments, the one or more processors may be implemented as a Complex Instruction Set Computer (CISC) or Reduced Instruction Set Computer (RISC) processors; x86 instruction set compatible processors, multi-core, or any other microprocessor or central processing unit (CPU). In various implementations, the one or more processors may be dual-core processor(s), dual-core mobile processor(s). and so forth.19ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025

[0091] Computer-related systems, computer systems, and systems, as used herein, include any combination of hardware and software. Examples of software may include software components, programs, applications, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computer code, computer code segments, words, values, symbols, or any combination thereof. Determining whether an embodiment is implemented using hardware elements and / or software elements may vary in accordance w ith any number of factors, such as desired computational rate, power levels, heat tolerances, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints.

[0092] For the purposes of this disclosure a module is a software, hardware, or firmware (or combinations thereof) system, process or functionality, or component thereof, that performs or facilitates the processes, features, and / or functions described herein (with or without human interaction or augmentation). A module can include sub-modules. Software components of a module may be stored on a computer readable medium for execution by a processor. Modules may be integral to one or more servers, or be loaded and executed by one or more servers. One or more modules may be grouped into an engine or an application.

[0093] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium which represents various logic within the processor, which when read by a machine causes the machine to fabricate logic to perform the techniques described herein. Such representations, known as “IP cores,” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that make the logic or processor. Of note, various embodiments described herein may, of course, be implemented using any appropriate hardware and / or computing software languages (e.g., C++, Objective-C, Swift, Java, JavaScript, Python, Perl, QT, and the like).

[0094] For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may be downloadable from a network, for example, a website, as a stand-alone product or as an add-in package for installation in an existing software application. For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may also be available as a client-server software application, or as a web-enabled software application. For example, exemplary20ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 software specifically programmed in accordance with one or more principles of the present disclosure may also be embodied as a software package installed on a hardware device.

[0095] For the purposes of this disclosure the term “user”, “subscriber” “consumer” or “customer” should be understood to refer to a user of an application or applications as described herein and / or a consumer of data supplied by a data provider. By way of example, and not limitation, the term “user” or “subscriber” can refer to a person who receives data provided by the data or sen-ice provider over the Internet in a browser session, or can refer to an automated software application which receives the data and stores or processes the data. Those skilled in the art will recognize that the methods and systems of the present disclosure may be implemented in many manners and as such are not to be limited by the foregoing exemplary embodiments and examples. In other words, functional elements being performed by single or multiple components, in various combinations of hardware and software or firmware, and individual functions, may be distributed among software applications at either the client level or server level or both. In this regard, any number of the features of the different embodiments described herein may be combined into single or multiple embodiments, and alternate embodiments having fewer than, or more than, all of the features described herein are possible.

[0096] Functionality may also be, in whole or in part, distributed among multiple components, in manners now known or to become known. Thus, myriad software / hardware / firmware combinations are possible in achieving the functions, features, interfaces and preferences described herein. Moreover, the scope of the present disclosure covers conventionally known manners for carrying out the described features and functions and interfaces, as well as those variations and modifications that may be made to the hardware or software or firmware components described herein as would be understood by those skilled in the art now and hereafter.

[0097] Furthermore, the embodiments of methods presented and described as flowcharts in this disclosure are provided by way of example in order to provide a more complete understanding of the technology. The disclosed methods are not limited to the operations and logical flow presented herein. Alternative embodiments are contemplated in which the order of the various operations is altered and in which sub-operations described as being part of a larger operation are performed independently.

[0098] While various embodiments have been described for purposes of this disclosure, such embodiments should not be deemed to limit the teaching of this disclosure to those embodiments. Various changes and modifications may be made to the elements and operations21ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 described above to obtain a result that remains within the scope of the systems and processes described in this disclosure.ACTIVE 714212269v1

Claims

Resideo Ref. No 214477- WO Attorney Docket No. 203863-017001 / PCT Electronically Filed: August 27, 2025CLAIMSWhat is claimed is:

1. A method comprising: monitoring, over a network, activity at a location, the monitoring comprising: periodically collecting data via a set of devices; analyzing the collected data; and detecting an event; further collecting, for a predetermined time period upon the detection of the event, data via at least a portion of the set of devices, the further collected data corresponding to detected activity at the location that is proximate to a respective device; determining a sequence of events based on the detected event and subsequent events identified via the further collected data during the predetermined time period; converting, in accordance with the determined sequence of events, the collected data and further collected data into a storyline animation, the storyline animation being an animated rendering of each of the detected and subsequent events; and storing the storyline animation in a storage location on a cloud associated with an account of the location.

2. The method of claim 1, further comprising: locally storing the collected data and the further collected data in storage associated with at least one of the set of devices.

3. The method of claim 2, further comprising: receiving a request, the request identifying the predetermined time period; and performing the generation of the storyline animation based on the request.

4. The method of claim 3, wherein the request corresponds to at least one of a request to generate the storyline animation and a request for information about a particular event.23ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 20255. The method of claim 3. wherein the performance comprises traversing the further collected data for the subsequent events and the collected data for the detected event in a reverse temporal order in accordance with the predetermined time period.

6. The method of claim 1. further comprising: triggering an alarm at the location upon detection of the event.

7. The method of claim 1, wherein the collected and further collected data comprises at least one of text, images, video, multi-media and artificial intelligence (Al) generated information.

8. The method of claim 1, further comprising: generating a data structure from the determined sequence of events; and storing the generated data structure, wherein the conversion is based on the data structure.

9. The method of claim 1 , further comprising: rendering the storyline animation on a display of a device.

10. A system comprising: a processor configured to: monitor, over a network, activity at a location, the monitoring comprising: periodically collecting data via a set of devices; analyzing the collected data; and detecting an event; further collect, for a predetermined time period upon the detection of the event, data via at least a portion of the set of devices, the further collected data corresponding to detected activity at the location that is proximate to a respective device; determine a sequence of events based on the detected event and subsequent events identified via the further collected data during the predetermined time period; convert, in accordance with the determined sequence of events, the collected data and further collected data into a storyline animation, the storyline animation being an animated rendering of each of the detected and subsequent events; and24ACTIVE 714212269v1Resideo Ref. No 214477- WOAttorney Docket No. 203863-017001 / PCTElectronically Filed: August 27, 2025 store the storyline animation in a storage location on a cloud associated with an account of the location.

11. The system of claim 10, wherein the processor is further configured to: locally store the collected data and the further collected data in storage associated with at least one of the set of devices.

12. The system of claim 11, wherein the processor is further configured to: receive a request, the request identifying the predetermined time period; and perform the generation of the storyline animation based on the request.

13. The system of claim 12, wherein the request corresponds to at least one of a request to generate the story line animation and a request for information about a particular event.

14. The system of claim 12, wherein the performance comprises traversing the further collected data for the subsequent events and the collected data for the detected event in a reverse temporal order in accordance with the predetermined time period.

15. The system of claim 10, wherein the processor is further configured to: triggering an alarm at the location upon detection of the event.

16. The system of claim 10, wherein the collected and further collected data comprises at least one of text, images, video, multi-media and artificial intelligence (Al) generated information.

17. The system of claim 10, wherein the processor is further configured to: generate a data structure from the determined sequence of events; and store the generated data structure, wherein the conversion is based on the data structure.

18. The system of claim 10, wherein the processor is further configured to: render the storyline animation on a display of a device.25ACTIVE 714212269v1Resideo Ref. No 214477- WO Attorney Docket No. 203863-017001 / PCT Electronically Filed: August 27, 202519. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions that when executed by a processor, perform a method comprising: monitoring, over a network, activity at a location, the monitoring comprising: periodically collecting data via a set of devices; analyzing the collected data; and detecting an event; further collecting, for a predetermined time period upon the detection of the event, data via at least a portion of the set of devices, the further collected data corresponding to detected activity at the location that is proximate to a respective device; determining a sequence of events based on the detected event and subsequent events identified via the further collected data during the predetermined time period; converting, in accordance with the determined sequence of events, the collected data and further collected data into a storyline animation, the storyline animation being an animated rendering of each of the detected and subsequent events; and storing the storyline animation in a storage location on a cloud associated with an account of the location.

20. The non-transitory computer-readable storage medium of claim 19. further comprising: locally storing the collected data and the further collected data in storage associated with at least one of the set of devices.26ACTIVE 714212269v1

Images