NetFlow has been widely adopted for network monitoring and analysis. In this paper, we propose a MapReduce-oriented rule structure for calculating statistics and detecting anomalies from NetFlow data, and present a unified MapReduce job architecture for one-pass analytics using rulesets. By applying our proposal to the SiLK, a CERT NetSA security suite for large-scale network monitoring we show that our rule-based MapReduce approach is easily deployed for managing lots of flow data. From the evaluation with a Hadoop testbed, we confirm that our rule-based MapReduce approach is a scalable and practical solution for analyzing a large volume of NetFlow.