diff --git a/features/iot-plugins-feature/virtual-fire-alarm-plugin-feature/org.wso2.carbon.device.mgt.iot.virtualfirealarm.feature/src/main/resources/advanced_agent/cep_query.txt b/features/iot-plugins-feature/virtual-fire-alarm-plugin-feature/org.wso2.carbon.device.mgt.iot.virtualfirealarm.feature/src/main/resources/advanced_agent/cep_query.txt
new file mode 100644
index 000000000..17546ece2
--- /dev/null
+++ b/features/iot-plugins-feature/virtual-fire-alarm-plugin-feature/org.wso2.carbon.device.mgt.iot.virtualfirealarm.feature/src/main/resources/advanced_agent/cep_query.txt
@@ -0,0 +1,11 @@
+define stream fireAlarmEventStream (deviceID string, temp int);
+from fireAlarmEventStream#window.time(7886776 sec)
+select deviceID, max(temp) as maxValue
+group by deviceID
+insert into analyzeStream for expired-events;
+from analyzeStream[maxValue < 88]
+select maxValue
+insert into bulbOnStream;
+from fireAlarmEventStream[temp > 1093]
+select deviceID, temp
+insert into bulbOffStream;
\ No newline at end of file