Building security system with event data analysis for generating false alarm rules for false alarm reduction

A method for generating a false alarm rule for preventing a false alarm that occurs at a building by one or more processing circuits, the method comprising:

• receiving, by the one or more processing circuits, building data for building devices of the building, wherein the building data comprises events of the building devices, wherein the events comprise a first non-alarm event, a second non-alarm event different than the first non-alarm event, and a false alarm event;
• generating, by the one or more processing circuits, an event sequence based on the events, wherein the event sequence comprises at least the first non-alarm event and the second non-alarm event and indicates a relationship between at least the first non-alarm event and the second non-alarm event that is indicative of a situation at the building that causes the false alarm event to occur;
• generating, by the one or more processing circuits, the false alarm rule based on the event sequence, wherein the false alarm rule comprises a recommendation for preventing the false alarm event from occurring;
• receiving, by the one or more processing circuits, first building data comprising first events associated with a first period of time;
• determining, by the one or more processing circuits, a number of times that the false alarm rule triggered during the first period of time based on the first building data;
• determining, by the one or more processing circuits, a predicted number of times that the false alarm rule will trigger in the future during a second period of time after the first period of time based on the number of times that the false alarm rule triggered during the first period of time;
• and
• generating, by the one or more processing circuits, an insight based on the predicted number of times the false alarm rule will trigger in the future during the second period of time and provide the insight to a user via a user device.

A non-transitory computer readable medium having machine instructions stored therein, the instructions being executable by a processor of a building management system to perform operations comprising:

• receiving building data for building devices of a building, wherein the building data comprises events of the building devices, wherein the events comprise a first non-alarm event, a second non-alarm event different than the first non-alarm event, and a false alarm event;
• generating an event sequence based on the events, wherein the event sequence comprises at least the first non-alarm event and the second non-alarm event and indicates a relationship between at least the first non-alarm event and the second non-alarm event that is indicative of a situation at the building that causes the false alarm event to occur;
• generating a false alarm rule based on the event sequence, wherein the false alarm rule comprises a recommendation for preventing the false alarm event from occurring;
• receiving second events from the building devices;
• determining whether the false alarm rule is triggered based on the second events;
• providing the recommendation of the false alarm rule to a user via a user interface in response to determining that the false alarm rule is triggered;
• receiving first building data comprising first events associated with a first period of time;
• determining a number of times that the false alarm rule triggered during the first period of time based on the first building data;
• determining a predicted number of times that the false alarm rule will trigger in the future during a second period of time after the first period of time based on the number of times that the false alarm rule triggered during the first period of time;
• and
• generating an insight based on the predicted number of times the false alarm rule will trigger in the future during the second period of time and provide the insight to the user via a user device.