A computer system is configured to process alarm activations received from technical systems, where an alarm activation represents a deviation of the technical status of a technical system from normal. The system includes: a data storage interface for receiving alarm activations in data storage, where the recorded alarm activations correspond to alarms; a data processor for: determining, from the recorded alarm activations, time intervals for alarm analysis; and computing similarity measures between the time intervals that depend on the occurrence of the recorded alarm activations in the time intervals, and where the contribution of an alarm activation to the similarity of two time intervals is reduced with an increasing occurrence of the alarm in the time intervals; and a user interface configured to provide pairs of time intervals to an operator of the one or more technical systems that include time intervals with similarity measures indicating similar alarm.