Management of “bad actor” alarms at a refinery