An example of the present invention provides a method and system for automatically suppressing false alarms in an IT system, such as an IT application. The method includes consolidating abnormal metrics into a single anomaly. A size of the anomaly relative to the IT application is determined, as well as a distribution of the anomaly in the IT application. A false alarm is determined based on the size and the distribution of the anomaly.