A method, an apparatus and an article of manufacture for detecting an event storm in a networked environment. The method includes receiving a plurality of events via a plurality of probes in a networked environment, each of the plurality of probes monitoring a monitored information technology (IT) element, aggregating the plurality of events received into an event set, and correlating the plurality of events in the event set to determine whether the plurality of events are part of an event storm by determining if the plurality of events in the event set meet one or more event storm criteria.