Varpulis

Sequences, not single events

This, then that, on the same host or across hosts, within a window: SASE+ sequences with negation, Kleene closures, aggregates and joins. A kill chain is one rule.

Log time, not arrival time

.within(2m) means two minutes between the timestamps in the logs. A replay a week later raises the same alerts; a burst of late events cannot fake a match.

State that survives a crash

A program's open sequences, windows and joins can be snapshotted with the stream position they stand for and restored into a fresh engine — the half-matched attack is not lost.

Trend aggregation

Hamlet shares work across many trend queries over bursty streams, where evaluating each query alone does not scale.

Forecasting

Prediction suffix trees estimate which pattern is completing, and how likely it is, with sub-microsecond inference.

A library, not a platform

The engine opens no socket and carries no async runtime. It runs inside Vejas as a detect unit, or offline with varpulis simulate.

What Varpulis is now

Varpulis is its engine. In September 2026 the platform around it — the server, the cluster, the SaaS layer and its connectors — was retired in favour of Vejas, an open-source event runtime that runs a Varpulis program as a detect unit: one durable JetStream consumer over the program's sources, alerts published before input is acknowledged, state snapshotted and resumed by stream sequence after a crash. The decision and its reasons are in ADR-008.

What stayed here is what a detection engineer writes and reads: the language, its semantics, the engines behind it, the scenarios and the SIEM Evasion Lab.

A rule, end to end

vpl

event SmbConnect:
    host: str
    target: str

event ServiceStart:
    host: str
    image: str

stream LateralMovement = SmbConnect as smb
    -> ServiceStart where host == smb.target as svc
    .within(2m)
    .emit(rule: "lateral_movement", from: smb.host, to: svc.host, image: svc.image)

bash

varpulis check lateral.vpl                      # ok, or the reason and the line
varpulis simulate -p lateral.vpl -e lateral.evt # every emit as a JSON line

On a bus, the same file under detects/ in Vejas is a running unit. The getting started walks through both.

Where to go next

The language — events, streams, operators, built-ins.

SASE+ semantics — what a sequence means, exactly.

Scenarios — kill chains, fraud, insider trading, patient safety.

Comparisons — against Flink, Esper, Arroyo, Proton and Kafka Streams.

The changelog.

Working on detection for a SOC? www.varpulis-cep.com has the fixed-price proof of concept, and a free first step: send three of your rules, get them back ported.

VarpulisThe detection engine