Embodiments determine event, e.g., performance degradation, security breach, etc., occurrence based on telemetry data. An embodiment receives telemetry data, e.g., data based on an HTTP transaction, and a rule associated with the telemetry data. The rule defines one or more filters for processing the telemetry data. In turn, a rule engine is modified in accordance with the received rule. The received telemetry data is processed with the modified rule engine to determine event occurrence.