[wsmith]

You may want to try using an ML algorithm called association rules, which produces rules automatically. Though acccounting for the sequence of events would be harder.