Embodiments are directed to monitoring a network flow. A characteristic of the monitored network flow may be compared to a criterion. A filter may provide the criterion. Filtered network traffic may be provided based on the filter and the comparison. A rule may be provided based on the filtered network traffic, such that each rule is associated with one or more rule prologues and one or more rule actions. The one or more rule prologues may be executed on the filtered network traffic to provide one or more satisfied rule prologues. One or more of the one or more rule actions may be executed based on the one or more satisfied rule prologues, such that the one or more executed rule actions and the one or more satisfied rule prologues are each associated with a same rule.