Methods, systems, apparatus, including computer programs encoded on computer storage medium, for predicting an outcome in response to a detected event. In one aspect, the method includes actions of maintaining a database of data records with a knowledge graph, receiving a stream of real-time data that includes data records, and from time-to-time as the real-time data is received: identifying a set of one or more attributes associated with a real-time event represented by one of the data records received, identifying a data record in the knowledge graph representing an event-outcome pair, determining that an event of the event-outcome pair has historically been associated with triggering an outcome of the event-outcome pair, and, executing a set of rules defining logic associated with the event-outcome pair specifying that the outcome will occur at a time that is subsequent to a time in which the one of the data records is received.