An embodiment for evaluating rules pertaining to an event includes providing a rule trie comprising multiple nodes, wherein match conditions must be met to trigger a given rule, and each match condition corresponds to a different node. An attribute trie is provided for a string attribute, which includes a node sequence having a value. The string attribute is extracted from the event and also has a value. The value of the extracted string attribute and the value of the node sequence are compared, by traversing a path extending along the node sequence. Responsive to determining that the values of the extracted string attribute and the node sequence are the same, notice is provided that the match condition of a particular node of the rule trie has been met by an attribute of the received event.