Active and passive learning from incidents