A method for reducing false alarms in a monitoring system comprising the steps of: providing an initial fault set (or a preliminary fault set) and using a decision process to successively reduce this initial fault set to a fault ensemble, said decision process using increasing probability or confidence in the initial fault set to generate the fault ensemble, which is considered to reflect a true abnormal condition; the decision process comprising at least two steps: the first step is generating a preliminary fault set by using a standard anomaly detection method with the additional variable (or adaptive) thresholds or temporal filters; the second step is using the preliminary fault set to generate at least one fault ensemble, each of which comprises a reduced number of refined faults that represent a more confident explanation of the cause(s) of an abnormal condition.