Convert a target ruleset to use event filters instead of thresholds