A method, comprising: receiving, at a network appliance, at an ingress port, a stream of network traffic; identifying, by the network appliance, a content insertion slot in the stream; obtaining, by the network appliance, a rule from a rule database, wherein an associated list of content is stored with the rule, and wherein the list of content lists content of different sizes and/or of different audio quality and/or of different video quality; determining, by the network appliance, inputs for the rule based on a context of the stream, wherein determining inputs for the rule comprises obtaining information about the end device; executing, by the network appliance, the rule with the inputs for the rule, wherein the execution of the rule results in a determination to insert content into the stream or not; in response to determining to insert content into the stream, determining insertable content to insert into the content insertion slot in the stream from the list of content, wherein determining insertable content to insert into the stream comprises: evaluating a current network performance metric, wherein the current network performance metric comprises available bandwidth of an egress port of the network appliance; and selecting insertable content based on the current network performance metric and a size and/or an audio quality and/or a video quality of the content; and in response to determining to insert content into the stream, transmitting by the network appliance over an egress port of the network appliance, the insertable content in the content insertion slot to an end device consuming the stream, while buffering the stream in a memory device of the network appliance. receiving, at a network appliance, at an ingress port, a stream of network traffic; identifying, by the network appliance, a content insertion slot in the stream; obtaining, by the network appliance, a rule from a rule database, wherein an associated list of content is stored with the rule, and wherein the list of content lists content of different sizes and/or of different audio quality and/or of different video quality; determining, by the network appliance, inputs for the rule based on a context of the stream, wherein determining inputs for the rule comprises obtaining information about the end device; executing, by the network appliance, the rule with the inputs for the rule, wherein the execution of the rule results in a determination to insert content into the stream or not; in response to determining to insert content into the stream, determining insertable content to insert into the content insertion slot in the stream from the list of content, wherein determining insertable content to insert into the stream comprises: evaluating a current network performance metric, wherein the current network performance metric comprises available bandwidth of an egress port of the network appliance; and selecting insertable content based on the current network performance metric and a size and/or an audio quality and/or a video quality of the content; and in response to determining to insert content into the stream, transmitting by the network appliance over an egress port of the network appliance, the insertable content in the content insertion slot to an end device consuming the stream, while buffering the stream in a memory device of the network appliance.