In some aspects, a method includes obtaining feature importance data associated with an alert and indicating relative importance of each of multiple sensor devices and of one or more simulated features. The method includes identifying a group of the sensor devices that have greater relative importance than a highest relative importance of any of the one or more simulated features. In some aspects, a method includes obtaining a reference list of alerts that are similar to a reference alert and a list of alerts predicted to be similar to the reference alert and ranked by predicted similarity to the reference alert. The method includes determining a score indicating similarity of the list to the reference list. A contribution of each alert in the list to the score is determined based on whether that alert appears in the reference list and the rank of that alert in the list.