A computer-implemented method includes receiving a plurality of values of a data stream, where the plurality of values are generated by a monitored device and received in real time. One or more statistical moments of the data stream are updated, by a computer processing device, based on each value of the plurality of values. Each value of the plurality of values is discarded, after updating the one or more statistical moments of the data stream based on that value. A threshold is set for the data stream based on the one or more statistical moments. It is detected that the threshold has been passed by the data stream. A remedial action is performed on the monitored device, responsive to the threshold being passed, where the remedial action is associated with the threshold.