1. A computer-implemented method comprising: obtaining a plurality of data objects that each include data corresponding to a respective event that has been classified into a particular event class using a hierarchical analytical model that defines one or more sets of attribute-specific criteria, wherein each data object (i) represents a unit of activity, and (ii) is associated with one or more attributes; generating a plurality of event clusters of the data objects that have been classified into the particular class based on features derived from values of the one or more attributes that are associated with each respective data object; identifying, for at least one of the generated event clusters, a differentiating feature that is (i) common to the clustered data objects in one cluster and (ii) not common to the clustered data objects in any of the other clusters; and updating the hierarchical model, wherein updating the hierarchical model includes adding the differentiating feature and a set of one or more criteria for the differentiating feature to the hierarchical analytical model to classify incoming events.