Pulsar is built with a modular architecture that makes it easy to maintain its existing features and extend it with new ones.
In Pulsar, every feature is implemented as a standalone module with no hard requirement on its environment. All the Pulsar modules work independely from each other, so you can enable, disable and configure modules easily through the Pulsar CLI tool.
A few examples of default-enabled Pulsar modules include:
filesystem-monitormodule for tracing I/O activity on the disk
process-monitormodule to keep track of process-related activity
rules-enginemodule to validate events against a set of policies.
See the modules reference section of the documentation for a deep dive of what each module is responsible for, and what kind of events it produced. If you are interested in writing your own Pulsar module, have a look at the official documentation here.
The Event Bus
The Pulsar modules can speak to each other via the main event bus, to which they are connected through a publisher/subscriber architecture.
The event bus is essentially the sink where all events collected by the modules are streamed, and can be used as a single source of truth for implementing additional modules that might rely on events collected by other modules, such as - for example - is the case for the special rules engine module.