How to detect anomalies in Real-Time Analytics: step by step

João Barros 13 de August de 2026 4 min read

Learn how to detect anomalies in Real-Time Analytics by applying a simple z-score technique over time windows. Detecting anomalies in Real-Time Analytics is useful to immediately identify failures, traffic spikes, or suspicious behavior and trigger alerts.

Prerequisites

An account and access to a platform that supports real-time queries (for example, Azure Data Explorer / Kusto or similar).
Data stream with a timestamp and a numeric metric (e.g.: latency, cpu, requests).
Basic knowledge of KQL (Kusto Query Language) or streaming SQL.

Step 1: Understand why to use z-score in Real-Time Analytics

The z-score normalizes values relative to the mean and standard deviation of the window. It is used to detect values that deviate significantly from normal behavior. In Real-Time Analytics it is simple, efficient and easy to interpret: values with a z-score above a threshold (e.g.: 3) are considered anomalous.

Step 2: Aggregate the metric by time windows

First, calculate the mean and standard deviation over a sliding window (e.g.: 5 minutes) to have temporal context. In KQL you use bin() with summarize by sliding_window or make-series; here we show an example with summarize by 1 minute and a simple windowing.

// Exemplo KQL: agregação por 1 minuto
let WindowSize = 1m;
StreamingTable
| where Timestamp >= ago(30m)
| summarize avg_value = avg(MetricValue), stdev_value = stdev(MetricValue), count = count() by bin(Timestamp, WindowSize)
| order by Timestamp asc

Step 3: Calculate the z-score for each point in real time

For each event or aggregated value, compute z = (value - mean) / std. If you are processing event-by-event, attach it to the context of the corresponding window. Using the aggregations from the previous step, apply the formula.

// Exemplo KQL: calcular z-score por janela
let WindowSize = 1m;
let Threshold = 3.0;
StreamingTable
| where Timestamp >= ago(30m)
| summarize avg_value = avg(MetricValue), stdev_value = stdev(MetricValue), last_value = max(MetricValue) by bin(Timestamp, WindowSize)
| extend z_score = iff(stdev_value == 0, 0.0, (last_value - avg_value) / stdev_value)
| extend is_anomaly = abs(z_score) > Threshold
| order by Timestamp asc

Step 4: Handle windows with few data points and avoid false positives

If the window has few events, the mean and standard deviation are not reliable. Define a minimum count and ignore small windows. You can also smooth the mean using EWMA to reduce sensitivity to noise.

// Exemplo KQL: ignorar janelas com poucos pontos
let WindowSize = 1m;
let MinCount = 5;
let Threshold = 3.0;
StreamingTable
| where Timestamp >= ago(30m)
| summarize avg_value = avg(MetricValue), stdev_value = stdev(MetricValue), cnt = count(), last_value = max(MetricValue) by bin(Timestamp, WindowSize)
| where cnt >= MinCount
| extend z_score = (last_value - avg_value) / stdev_value
| extend is_anomaly = abs(z_score) > Threshold
| order by Timestamp asc

Step 5: Generate real-time alerts

When is_anomaly is true, create an action: log it to an alerts table, send to a webhook or to a notification system. Many Real-Time Analytics systems allow wiring a query to an alert. Store useful information: Timestamp, value, z_score, window.

// Exemplo KQL: resultados de anomalia para exportar
let WindowSize = 1m;
let MinCount = 5;
let Threshold = 3.0;
StreamingTable
| where Timestamp >= ago(30m)
| summarize avg_value = avg(MetricValue), stdev_value = stdev(MetricValue), cnt = count(), last_value = max(MetricValue) by bin(Timestamp, WindowSize)
| where cnt >= MinCount
| extend z_score = (last_value - avg_value) / stdev_value
| where abs(z_score) > Threshold
| project AlertTime = Timestamp, Value = last_value, z_score, cnt, avg_value

Verify the result

Confirm that you have rows with is_anomaly = true or that the alert query returns events. Manually validate some events: compare the value and the context (mean and stdev) to ensure they are indeed anomalies. Also check windows with cnt < MinCount so you don't miss important cases.

Conclusion

Detecting anomalies in Real-Time Analytics with z-score is a fast and interpretable approach to identify deviations. Next steps: experiment with EWMA, machine learning models (e.g.: Isolation Forest) or combine multiple metrics to reduce false positives. Tip: start with conservative thresholds and adjust based on false positives/negatives — which metric worries you most?