This whole example represents a common workflow in fraud detection (alerts on data that hits a certain pattern). However, when I worked at Braintree, doing this real-time was tough and we'd analyze stuff retrospectively.