In one embodiment, a method includes receiving notifications of events associated with the connected devices, evaluating a plurality of event sequences that include two or more events occurring within a particular time period, and generating a plurality of rules based on the evaluated event sequences. The method further includes receiving a notification of a first event associated with a first connected device on the network, determining that a first rule of the plurality of rules is based on the first event, and sending one or more instructions to connected devices in accordance with the first rule.