Pulsar is designed as an
event-driven runtime security framework, so events naturally play a big role in the way security is monitored and enforced by the agent.
In Pulsar, events are the most granular representation of all the operations performed by the operating system and they are the building block on top of which threats are detected by the rules engine.
While events usually represent an enriched version of
kernel activity traces extracted by one of the Pulsar modules through
eBPF, they are not restricted to that in any way. In fact, any piece of information published on the
event bus - provided it satisfies a few formal constraints - can be considered an event, regardless of its original source. This also incidentally means that Pulsar modules that live completely in the user space can produce and consume events from the event bus without any restriction, allowing for great extensibility of Pulsar features.
A few examples of events include:
- Program execution
- File creation
- Connection start
The event header contains general information about the events origin, such as the process that it's generating, its timestamp and its source module.
The event payload, on the other hand, contains the actual specifics of the event, and is dictated by the event type.