1. An automated surveillance system, comprising: one or more media capture devices that capture media, and that generate media metadata and alarms; a graphical user interface communicating the alarms and the captured media to security personnel together with alarm handling rules; and a learning module that iteratively learns operation sequences executed by the security personnel during the handling of a set of alarms, extracts alarm handling rules from the operation sequences, and presents the alarm handling rules to the security personnel via said graphical user interface.