A controller for a building management system includes a first data interface configured to receive data from the building management system and a processing circuit including a processor and a memory device storing a fault detection rule having an initial threshold value. The processing circuit is configured to detect a first fault in the building management system using the stored fault detection rule having the initial threshold value and to use the data from the building management system to determine whether an adjustment to the stored fault detection rule is needed. In response to a determination that an adjustment to the stored fault detection rule is needed, the processing circuit is configured to calculate a new threshold value for the stored fault detection rule and update the stored fault detection rule by replacing the initial threshold value with the new threshold value.