1. A method comprising: identifying a first rule applicable to a first event indication, wherein the first event indication was generated by an agent at a first component; creating a first instance of the first rule which includes first state data; tagging and storing the first event indication with an identifier for the first instance of the first rule; updating the first state data based, at least in part, on the first event indication; based on receipt of a second event indication from the agent of the first component, determining that the first rule is applicable to the second event indication; based on determining that the first instance of the first rule already exists, tagging and storing the second event indication with the identifier for the first instance of the first rule; and updating the first state data based, at least in part, on the second event indication; generating a third event indication based, at least in part, on the first state data indicating that a condition for the first instance of the first rule has been satisfied; determining that a first alarm is to be generated based, at least in part, on the third event indication; generating the first alarm with the identifier for the first instance of the first rule; and based on receipt of a request for events contributing to the first alarm, retrieving at least the first and second event indications based, at least in part, on the identifier for the first instance of the first rule.