Abstract: A method of processing data such as alarms from a communications network, by alarm correlation, the network comprising entities which offer and receive services to and from each other, the method comprising the step of: adapting a virtual model (87) of the network according to events in the network. The model comprises a plurality of managed units (91,92) corresponding to the network entities, each of said units containing information about the services offered and received by its corresponding entity to and from other entities, and having associated knowledge based reasoning capacity such as rules, for adapting the model by adapting said information. When one of the managed units is notified of an event such as an alarm raised by its corresponding entity, the cause of the alarm is determined using the virtual model. The development and maintenance of rules is easier, and correlation quicker since the rules for each unit need not relate to all the other units.