For rare events, instead of counting and looking to see if they are too high in a particular time period, you want to see if they are happening too fast in real time. A simple CUSUM control chart algorithm (in R code) looks like:
```
l <- 0.8/30 # rate of 0.8/30 events per day
tb <- c(7,6,12,9,10) # days between events
p <- pexp(tb,l) # exponential PDF
snorm <- qnorm(p) # turning into normal dist
cn <- cumsum(snorm) # alarm if < -4
```
You alarm here if `cn` gets below -4. (That is the standard for CUSUM control charts with a SD of 1 and mean of 0.)
If counting events per month, this example you would probably only have one month with 3 events and another with 2, which are not that rare individually with a rate of 0.8 events per month on average. And even if the month was anomalous, you would wait until the end of the reporting period and then see there was a problem, not earlier.
But seeing this string of events nearby in time suggests the process has potentially changed.
If you determine that it was random chance, you would reset the cumulative sum to zero and start again.