Apparatus and associated methods relate to dynamically generating a rule for determining an alert condition for an Internet of Things (IoT) device. The rule is dynamically generated for determining an alert condition that is appropriate to a specific use or application of the IoT device. A processor receives a device-data definition and captures a specific one of a plurality of selectable use cases of the IoT device. The processor generates the rule for determining an alert condition based, at least in part, on the specific one of the plurality of selectable use cases captured. The processor receives a data stream provided by the IoT component and applies the rule generated to the data stream. The processor determines the alert condition based on the rule applied to the data stream and generates an alert signal in response to the rule applied to the data stream satisfying the alert condition determined.