Fabric RTI 101: Detecting Patterns Using Activator

In many real-time systems, a single event on its own doesn’t tell the full story. Pattern detection allows you to identify sequences or combinations of events that together indicate something meaningful.

For example, a single failed login attempt is rarely an issue, but multiple failed logins within five minutes could suggest a security concern. Similarly, a single temperature reading above normal might not matter, but a rising trend over time could signal equipment failure.

These kinds of patterns help us move beyond simple thresholds to understand behaviour over time or relationships between events.

In Activator, pattern detection is handled through rules that monitor event sequences or time windows. You can define conditions that must occur in order or within a defined time range. For instance, a rule might watch for three warning events followed by one failure event within a ten-minute window.

Many of these same capabilities are also available through KQL functions such as series_decompose, series_outliers, or join kind=innerunique, which can help identify patterns or correlations directly in queries before they’re fed into Activator.

Pattern detection supports a wide range of advanced scenarios — from fraud detection, to IoT monitoring, to real-time operational analytics — anywhere you need to understand not just single data points, but how events evolve and relate over time.

Ultimately, pattern detection helps your automation respond to context, not just to isolated events.

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-07-24