A method for automatically generating alarm aggregation rules using a computer system , the method comprising: receiving, by the computer system, information descriptive of a hierarchy of devices within a set of devices, each device within the set having one or more further devices within the set that are associated with the device and each device of the set being capable of entering at least one anomalous state wherein the hierarchy is an electrical distribution hierarchy; defining an alarm aggregation rule, based on the information descriptive of the hierarchy of devices within the set of devices and information descriptive of possible physical or logical states of the devices, wherein the alarm aggregation rule includes a description of an alarm origin; and storing an association between the alarm aggregation rule and the set of devices, the method further comprising the steps of: receiving information descriptive of at least one alarm; determining that the at least one alarm is subject to the alarm aggregation rule; identifying an origin device at the alarm origin based on the information descriptive of the at least one alarm, the alarm aggregation rule, and the information descriptive of the hierarchy of devices within the set of devices, wherein identifying the origin device includes identifying whether other alarms are associated with devices upstream or downstream of the origin device in the electrical distribution hierarchy; and taking corrective action, based on the aggregated alarm. receiving, by the computer system, information descriptive of a hierarchy of devices within a set of devices, each device within the set having one or more further devices within the set that are associated with the device and each device of the set being capable of entering at least one anomalous state wherein the hierarchy is an electrical distribution hierarchy; defining an alarm aggregation rule, based on the information descriptive of the hierarchy of devices within the set of devices and information descriptive of possible physical or logical states of the devices, wherein the alarm aggregation rule includes a description of an alarm origin; and storing an association between the alarm aggregation rule and the set of devices, the method further comprising the steps of: receiving information descriptive of at least one alarm; determining that the at least one alarm is subject to the alarm aggregation rule; identifying an origin device at the alarm origin based on the information descriptive of the at least one alarm, the alarm aggregation rule, and the information descriptive of the hierarchy of devices within the set of devices, wherein identifying the origin device includes identifying whether other alarms are associated with devices upstream or downstream of the origin device in the electrical distribution hierarchy; and taking corrective action, based on the aggregated alarm. receiving information descriptive of at least one alarm; determining that the at least one alarm is subject to the alarm aggregation rule; identifying an origin device at the alarm origin based on the information descriptive of the at least one alarm, the alarm aggregation rule, and the information descriptive of the hierarchy of devices within the set of devices, wherein identifying the origin device includes identifying whether other alarms are associated with devices upstream or downstream of the origin device in the electrical distribution hierarchy; and taking corrective action, based on the aggregated alarm. <EOS>