so at event time, run a query to collect data and if some pattern matches the query result, raise an alert