In some embodiments, a real-time and interactive preview of alerts is provided in a user interface. A computer system parses a set of rules that specifies an alert definition. Each rule identifies a set of observations and an alert trigger criterion based on user input in the user interface. For a rule, the computer system accesses historical data corresponding to the set of observations identified by the rule and determines, based on an analysis of the historical data, time points that trigger alerts over a time period according to the rule. The analysis is based on the alert trigger criterion identified by the rule. The computer system aggregates, based on the alert definition, the time points determined for the rule with time points determined for another rule from the set of rules. Further, the computer system generates an alert preview over the time period for presentation at the user interface.