This paper gives an algebraic derivation of the posterior for both the noisy-or and naive Bayes models, as a function of both input messages and probability table parameters. By examining these functions we show a technique where the naive Bayes model may be used to approximate a logical-OR, rather than its typical interpretation as a logical-AND. The technique is to avoid the use of disconfirming evidence in the naive Bayes model. A comparison with the posterior function for the noisy-or shows the quality of the logical-OR naive Bayes approximation. This approximation is key to the assumption of the underlying tree structure in a certain class of diagnostic Bayes’ networks, where the tree structure mimics an is-a hierarchy. We argue that this is the correct causal structure. An example of applying the Bayes’ network model to network intrusion detection illustrates this. This assumption that a tree-structured diagnostic Bayes’ network can be formulated from an is-a hierarchy is a useful elicitation tool. We have addressed the quality of the numeric approximation in this assumption; the exact nature of cause in an is-a hierarchy remains an open question.