An alarm management system includes a plurality of data sources configured to provide data relating to an event at a building and a processing circuit. The processing circuit is configured to receive the data from the data sources, apply a Bayesian network model to the data to generate a probability score for each of a plurality of possible causes of the event, identify the most probable cause of the event as a first cause of the plurality of possible causes having a highest probability score, execute an action with respect to the identified most probable cause of the event.