Pulsar is built with a modular architecture that makes it easy to maintain its existing features and extend it with new ones.
Rules are a central concept in Pulsar because they are used to ultimately determine whether any event is a safe or a threat.
At the core of Pulsar there is eBPF (enhanced Barkeley's Packet Filters) technology. eBPF is the state of the art of Linux kernel tracing and instrumentation technology. An eBPF virtual machine is a virtual machine capable of running "BPF programs" inside the Linux kernel.