A system, method and computer readable medium for examining a specimen, the method comprising: obtaining defects of interest (DOIs) and false alarms (FAs) from a review subset selected from a group of potential defects received from an inspection tool, each potential defect is associated with attribute values defining a location of the potential defect in an attribute space; generating a representative subset of the group, comprising potential defects selected in accordance with a distribution of the potential defects within the attribute space, and indicating the potential defects in the representative subset as FA; and training a classifier using data informative of the attribute values of the DOIs, the potential defects of the representative subset, and respective indications thereof as DOIs or FAs, wherein the trained classifier is to be applied to at least some of the potential defects to obtain an estimation of a number of expected DOIs.