Implementations described and claimed herein provide systems and methods systems and methods for managing network health, including alarm reduction in a subnetwork. In one implementation, an alarm list is received. The alarm list has alarm data captured from a plurality of remote nodes and consolidated at an aggregator node. A first alarm corresponding to an optical interface deployed in a circuit of a telecommunications subnetwork is identified from the alarm list. A topology associated with the optical interface is discovered by traversing a path of the circuit. An interface list is generated based on the topology. One or more alarms related to a root cause of the first alarm are identified based on a comparison of the interface list to the alarm list. The related alarms are correlated to the first alarm for concurrent resolution.