Abstract: Data characterizing a plurality of sensor generated events is received. Thereafter, analysis of the plurality of events is initiated using a decision tree with splits performed on decision keys. A first portion of the decision keys comprising analyst-selected splits can be derived from user-generated domain knowledge regarding a first plurality of historical events. A second portion of the decision keys comprising software-driven splits can be derived from a predictive model trained using a second plurality of historical events. Later, a disposition is determined for each event based on a traversal of at least one of the decision keys in the decision tree and such disposition is later initiated. Related apparatus, systems, techniques and articles are also described.