1. An apparatus, comprising: a network interface that is coupled to a data network for receiving one or more packet flows therefrom; a processor; one or more stored sequences of instructions which, when executed by the processor, cause the processor to perform: detecting, at a first network entity, an occurrence of a particular network condition; comparing, by the first network entity, the particular network condition with one or more sample set of rules of a first sample set of rules that are associated with the first network entity, wherein the first sample set of rules is a subset of rules from a full set of rules that is stored at a rule base, wherein each rule from the full set of rules represents a network condition and an action to be taken in response to an occurrence of the network condition; and in response to determining that the particular network condition matches a particular rule from the first sample set of rules, notifying, by the first network entity, the rule base or one or more second network entities of the match between the particular network condition and the particular rule from the first sample set of rules, wherein each second network entity is associated with a second sample set of rules comprising at least one rule that is different than in the first sample set of rules and comprising a subset of rules from the full set of rules; wherein the notifying causes a particular network entity of the one or more second network entities to add the particular rule to a respective sample rule set associated with the particular network entity.