Service Level Expressions
Expressions are used in determining the current state of a probe or event in an event log. In a legacy system, if the user is trying to create a bandwidth usage alert on a serial interface, they might create a rule like ">1000 Kbps". This would make sense for an interface that can handle up to 1500Kbps.

But what happens to this rule when it is used for an interface that has a maximum capacity of 10 Mbps?  The rule no longer works. 

AutoNOC is different from legacy systems in that it allows the user to define dynamically evaluated service level expressions. For instance, rather than say ">1000 Kbps" in AutoNOC, you would say ">.66*%IFSPEEDIN".  Your rule, defined once, will then work for any interface! All service level expressions can be defined in this way.

Probe Acquisition Expressions
Authorable expressions are even used to describe how probes work and acquire information! Every AutoNOC probe template has an associated expression. A full discussion of designing custom probe expressions is beyond the scope of this overview, but here are a couple probe expression examples if you are interested:

Ping
ICMP_GetResponseTime(%IP)

Gopher Service
SOCK_IsListening(%IP,70)

FTP Anonymous Users
SNMP_Get(%IP,%SNMPCOMMUNITY,.1.3.6.1.4.1.311.1.7.2.1.7)

Total Traffic (Standard)
((SNMP_GetByRowMatch(
   %IP,%SNMPCOMMUNITY,
   .1.3.6.1.2.1.2.2.1.10,
   .1.3.6.1.2.1.2.2.1.2,
   %SNMPNAME,
   .1.3.6.1.2.1.2.2.1.1,
   %IFINDEX)- Previous(0))
+(SNMP_GetByRowMatch(
   %IP,%SNMPCOMMUNITY,
   .1.3.6.1.2.1.2.2.1.16,
   .1.3.6.1.2.1.2.2.1.2,
   %SNMPNAME,
   .1.3.6.1.2.1.2.2.1.1,
   %IFINDEX)- Previous(1)))
   / ( (Elapsed(0)+Elapsed(1)) / 2 )
      / 1024 * 8