Hi @EricIronside ,
I believe that you're spot on with the issue.
I'd performed an administrative reset (as defined in another post by @RJSunderman separately) on geoevent, in order to solve the issue causing the geoevent manager to not appear (which seems to be related to copying of SSL certificate keystore) and it appears that the TRACK_ID designation on the GE Definitions weren't imported/exported as part of the xml backup. Not sure if this is by design, or is just understood, or was a bug, but is a good one to know can occur.
In the case of this geoevent definition, as they must have automatically regenerated the first time events were run after the site configuration was imported, the TRACK_ID was not set on the regenerated definitions. Strangely the GE Definitions would be duplicated also, so possible something to do with site export/import.
I'm guessing based on your comments above, that it would be better practice to clone the automatically created GE definition and set the TRACK_ID, and to not use the automatically generated definitions in the GE Service as the above issues can occur.
Once the TRACK_ID value was set on the GE definitions, the Incident Detector started working again.
Thanks!