Detecting unauthorized or excessive use of a resource is disclosed. The value of a metric is updated based at least in part on a first data associated with a current event associated with the metric and a second data associated with a most recent prior event associated with the metric. Responsive action is taken if the updated value of the metric exceeds a threshold.