1. A system comprising: a plurality of computer nodes, one of the plurality of computer nodes being configured to: store information for a plurality of instances; receive information identifying a condition from a particular computer node of the plurality computer nodes; analyze the condition and the plurality of instances to identify one or more instances, of the plurality of instances, that match the condition; determine statistics for the condition based on the information for the one or more instances that match the condition; send the statistics to the particular computer node, the particular computer node generating a rule based on the statistics; and receive the rule from the particular computer node.