In accordance with an embodiment, a method and system are provided to create and analyze grouped events. The method and system involve obtaining, at a network node, event data of measured real events detected at one or more locations of a monitored system according to a first criterion. The event data for each real event defines one or more parameters/dimensions of the real event. The method and system further involve aggregating the detected real events into groups according to at least one or more parameters/dimensions of the detected real events, and analyzing one or more of the aggregated groups of detected events to identify conditions on the monitored system or take action when a condition is identified from the one or more aggregated groups of tracked events. The tracked real events may include an alarm event as well as a system event.