Information describing a rule to be applied to a traffic stream is received at an edge network device. The traffic stream is received at the edge network device. A preliminary data analysis of the traffic stream is performed at the edge network device in accordance with the rule. A determination is made that further analysis of the traffic stream should be performed from a result of the preliminary analysis. The traffic stream data is sent to another network device for further analysis.