1. An apparatus comprising: a non-transitory computer readable medium; a processor; and an agent configured to: receive information from an electrical power grid, identify an event from the information, classify the event, determine whether to initiate an action based on a classification of the event, initiate the action in response to a determination to initiate the action, determine if a message that causes another action that results in the event is an expected message, determine if the event is a normal event, and classify the event based on whether the message is the expected message and whether the event is the normal event.