Real time detection of anomalies may be implemented for a data stream. A data stream may receive data records as input. An evaluation of the data records may be performed as the data records are received utilizing an anomaly detection model that is dynamically generated for a time period that includes the data records. A responsive action may be performed in response to detecting various anomalies, such as providing a notification of the anomaly, requesting a corrective action, invoking further analysis of the detected anomaly. Evaluations of the data record and responsive actions may be performed as specified by a user, in some embodiments.