A DVM system is configured to include an incident trigger, which is actuated either manually or automatically in response to an “incident. In response to the actuation of the trigger, an incident identifier is defined. During the period of actuation, a plurality of recordings is automatically made, based on an incident recording protocol. These recordings are all associated with the incident identifier. The automation allows an operator to, at the time of the incident, focus on factors other than ensuring important video evidence is being recorded (such as following a subject through a building by looking at various cameras). The association streamlines subsequent review of an incident, as recordings relevant to the incident are commonly identifiable based on the incident identifier.