Skip to main content

Modules

Pulsar is built with a modular architecture that makes it easy to maintain its existing features and extend it with new ones.

Overview​

In Pulsar, every feature is implemented as a standalone module with no hard requirement on its environment. All the Pulsar modules work independely from each other, so you can enable, disable and configure modules easily through the Pulsar CLI tool.

Architecture

A few examples of default-enabled Pulsar modules include:

  • filesystem-monitor for tracing I/O activity on the disk

  • process-monitor to keep track of process-related activity

  • rules-engine to validate events against a set of policies.

See the modules reference section of the documentation for a deep dive of what each module is responsible for, and what kind of events it produced.

tip

If you are interested in writing custom Pulsar modules, have a look at the official documentation here.

The Event Bus​

The Pulsar modules can speak to each other via the main event bus, to which they are connected through a publisher/subscriber architecture.

The event bus is essentially the sink where all events collected by the modules are streamed, and can be used as a single source of truth for implementing additional modules that might rely on events collected by other modules, such as - for example - is the case for the special rules engine module.