Logical rules can be automatically generated for use with event detection systems according to some aspects of the present disclosure. For example, a computing device can extract a group of logical rules from trained decision trees and apply a test data set to the group of logical rules to determine count values corresponding to the logical rules. The computing device can then determine performance metric values based on the count values, select a subset of logical rules from among the group of logical rules based on the performance metric values, and provide at least one logical rule in the subset for use with an event detection system. The event detection system can be configured to detect an event in relation to a target data set that was not used to train the decision trees.