Information describing a rule to be applied to a traffic stream is received at an edge network device. The traffic stream is received at the edge network device. A schema is applied to the traffic stream at the edge network device. It is determined that a rule triggering condition has been met. The rule is applied to the traffic stream, at the edge network device, in response to the rule triggering condition having been met. At least one of determining that the rule triggering event has taken place or applying the rule is performed based on the applied schema.