Methods and apparatuses, including computer program products, are described for applying service based on classification and grouping of traffic flows. The method includes receiving a traffic flow, and matching the traffic flow to classification groups. The matching includes determining a first event associated with the traffic flow, comparing attributes of the first event with entry criteria of the classification groups, and assigning the first event to one or more classification groups where the first event meets the entry criteria of the one or more classification groups. The method includes identifying one or more service definitions for the traffic flow based on the classification groups assigned to the traffic flow, reconciling the one or more service definitions for the traffic flow, and providing a service to the traffic flow based on the reconciled service definitions.