Events received from event sources are processed with respect to components of a computer network. Responsive to receiving an event, it is determined that the event is associated with an event rule based on criteria of the event rule. An alert is generated responsive to the event meeting an alert threshold of the event rule. The alert is then bound to a configuration item identified using at least one configuration item type and at least one configuration item attribute included in the event rule. The alert is enriched by adding one or more attributes of the configuration item to the alert according to enrichment criteria included in the event rule. The event rule is built using sequentially receiving user input. The event rule can be tested by applying the event rule to a plurality of test events. The event rule can be published for use in generating alerts.