Techniques are described for selecting an alarm state based at least in part on determining a security event related to security and automation systems. One method includes receiving, from a sensor, a first indication of a security event at the first location, determining a first threat level based on the security event, and activating a first alarm state based at least in part on the first threat level.