A method is disclosed. A server computer may receive, from a client computer, a first rule comprising one or more variables, the first rule configured to predict that an event is either a first classification or a second classification. The server computer applies the first rule to an initial data set of events to identify events that are associated with the first classification. The server computer evaluates performance of the first rule. The server computer provides data relating to the performance of the first rule to the client computer. The client computer automatically evaluates the performance of the first rule and generates a second rule in response to the data relating to the performance of the first rule. The server computer may then evaluate the second rule and provide performance data to the client computer. The server computer may use equi-height histograms to evaluate the performance of the rules.