A classifier, method and computer program product for categorizing events within a data stream includes a correlation engine having at least one set of rules, the rules including event selectors with logical expressions corresponding to a plurality of attributes for the events within the data stream; the engine also including a decision tree built by the engine for providing an index of the rules, wherein the engine references the decision tree to access selected rules corresponding to the events and applies the selected rules to correlate the events.