In one embodiment, a device in a network aggregates values for a set of key performance indicators (KPIs) for a system the network to form a plurality of KPI states. The device associates a plurality of observed performance metric values from the system with the KPI states. The device constructs a machine learning-based decision tree. Internal vertices of the decision tree represent conditions for the plurality of observed performance metric values and leaves of the tree represent the KPI states. The device predicts a KPI state by using the machine learning-based decision tree to analyze live performance metric values streamed from the system. The device generates a proactive alert based on the predicted KPI state.