3. The method of claim 1 wherein outputting the new rule comprises replacing one of the current rules.
4. The method of claim 3 further comprising: testing performance of the one of the current rules; and testing performance of the new rule; wherein the replacing is performed where the performance of the new rule results in fewer event discards than the performance of the one of the current rules.