Expression Engine

Compact Syntax

"social": {
  "criteria": "ac:social-media",
  "targets": [
    "ctmark.low-priority"
  ]
}

Standard Syntax

The standard syntax provides the most flexible and expressive way to define flow classification rules in Netify. It supports full logical expressions that can evaluate a wide range of flow attributes, including application, protocol, IP and MAC addresses, ports, and category metadata.

Unlike the compact syntax, standard expressions are designed for more advanced use cases where precise control, compound conditions, or layered logic is required. This makes it the preferred approach for production policies, complex filtering, and fine-grained traffic classification.

"criteria": "detected_hostname == 'rx:.*xxx';"

"criteria": "(a || b) && c;"

"criteria": [
    "application == 'youtube';",
    "protocol_id == 20;",
    "protocol == 'icmp';",
    "category == 'adult';",
    "application == 'netify.linkedin';"
]

...
"criteria": "*"
"interface": "br0",
...

"criteria": "${path_state_persistent}/nfa-priority.d"

app == 'netify.rockstar-games';
app == 'netify.epic-games';
app == 'netify.ea-games';

Intelligence Object

The Intel plugin enriches network flows with real-time classification, threat assessments, and custom policy indicators. In addition to local scoring, it can fire off events directly to the Netify Flow Actions plugin, allowing dynamic rules to take action (e.g., shaping, prioritizing, or blocking) based on the intelligence data received.

To learn how to configure the Intel plugin to forward events to Netify Flow Actions, refer to the Intel Plugin Setup Guide.

Suppose an Intel indicator is configured as follows to define individual games we might want to prioritize:

{
  "indicators": {
    <snip>...
    "games": {
      "indicator_driver": "category",
      "enabled": true,
      "score": 80,
      "categories": [
        12
      ],
      "cache": {
        "max_age": 86400,
        "max_size": 500,
        "filename": "${path_state_persistent}/intel-cache/games.dat",
        "flow_keys": [
          "host_server_name",
          "dns_host_name"
        ]
      },
      "criteria": {
        "description": "Games",
        "flow_expr": "application_id == 0 and protocol_id != 5 and other_type == other_remote;",
        "netify_events": [
          "category_games",
          "nfa_prioritize"
        ]
      },
      "data_feeds": [
        "cloud_intel"
      ],
      "sink_targets": [
        "default-log",
        "default-socket"
      ]
    },
    ...</snip>
}

Intel Object Evaluation in the Expression Engine

When an event reaches the Netify Flow Actions plugin, the payload includes an intel array containing intelligence objects matched during analysis. Consider the following array element payload:

"intel": [
    {
        "category": "custom",
        "criteria": {
            "min_bytes": 0,
            "min_score": 10,
            "trigger_on_east_west": true,
            "trigger_on_wan": true
        },
        "data_feed": "",
        "event": "dpi_complete",
        "indicator": "games",
        "indicator_driver": "custom",
        "score": 50
    }
]

Variable Name Flattening & Substitution

The Expression Engine automatically exposes every top-level attribute of the Intel object, as well as any nested attributes inside the criteria block, as evaluate-able expression variables.

This matching works by prefixing the top-level intel object name and using an underscore (_) as a delimiter:

• Top-level attributes map directly using intel_<attribute> (e.g., category becomes intel_category).
• Nested criteria attributes concatenate their parent key path with an underscore using intel_criteria_<attribute> (e.g., min_score inside criteria becomes intel_criteria_min_score).

Based on this rule, the following dynamic keywords are automatically available in your expression scope:

• intel_category
• intel_criteria_min_bytes
• intel_criteria_min_score
• intel_criteria_trigger_on_east_west
• intel_criteria_trigger_on_wan
• intel_data_feed
• intel_event
• intel_indicator
• intel_indicator_driver
• intel_score

You can immediately use these flattened keywords inside your Flow Actions expressions to evaluate conditions:

intel_indicator == "games" and intel_criteria_trigger_on_wan == true and intel_score >= 10

Criteria Reference

Data Types

The data types used in the expression engine are detailed below. The address attribute is a flexible format that supports IPs, CIDRs, MACs and address groups.

Attributes