If I correctly understand your question, you're trying to trigger an event alert based on observing a data stream. What will actually work in any situation depends on the nature of both the data stream and the event.

In general, you need an agent program constantly running in the background. The agent observes the data stream, watching for a pattern of changes. Upon seeing the change, it activates an alarm function.

For example, suppose the data stream is a series of GPS locations of a boat doing a patrol. Suppose the patrol pattern is a back and forth motion between two waypoints, and you want an alert whenever the boat deviates from that pattern. You might program the agent to set a minor alarm whenever the velocity (speed/direction) changes by more than, say, 20% at a waypoint (this would signal the end of a patrol pass). If the velocity changes at any position other than a waypoint, it signals a major event. The agent would then trigger a more significant alarm.

The point is that the agent watches for a significant pattern in the data stream, and activates when it senses that pattern. The same logic works for multiple data streams and any observable pattern. Without more information about the situation you're dealing with, I can't be any more specific.

Dear Charles Masi , thank you for your point of view. I suppose that the underlying supposition is the data homogeneity on the same data stream coming from a data source. But, What happens when the data source is something like an Arduino and the same data stream contains data coming from different kind of sensors? How do you think that each concept could be identified and understood in order to make a decision?

Perhaps we mean something different by the words "data stream." To me it means an unbroken time-stamped series of readings from a single sensor. That logically precludes the possibility that it " contains data coming from different kind[s] of sensors." A "different kind" of sensor would be a different sensor and come through a different stream. Your agent program can look at more than one stream and sense patterns of cross-correlation between those streams.

For example, you might look for a spike of readings from one sensor coincident with a trough of readings from another. In fact, you would prefer to have any alarms triggered by correlations among readings from multiple separate sensors to minimize false alarms.

The recent difficulty with Boeing 737 Max attack-angle sensors might have been avoided if the flight computer had watched streams from both of the sensors that were available and disengaged the MCAS if they disagreed by some given percentage while warning pilots that there was an attack-angle sensor problem.

The point is that multiple sensors "touch" the real world in different places and each provides a stream of readings reporting conditions at one of those different places. It is then a real-time computing problem to sense and understand patterns in those readings. It sounds like you may be trying to mix and match raw sensor data streams too early in your logical process.

Think of data as starting out as a broad array of multiple streams. Your data analysis (its actually a synthesis process, but people get in the habit of using wrong words) is then a series of steps funneling that data down to a single-bit result -- to trigger an alarm NOW or not. The reason I call it a synthesis process is that, while much of the data gets thrown away as irrelevant TO THAT ALARM-TRIGGER PROBLEM, the important stuff consists of logically combining observations from relevant streams via some species of pattern recognition.

I hope that makes sense and helps.