Varpulis Documentation

Varpulis is a complex-event-processing engine, embedded as a library in a host that owns the bus; the reference host is Vejas, where a VPL program is a detect unit (ADR-008).

Start here

• Getting started — install varpulis, check a program, simulate it over an event file, embed the engine.
• The language — events, streams, operators, built-ins, keywords, the grammar.
• Language tutorial.

Semantics and engines

• SASE+ semantics, emission modes, SASE patterns.
• Windows and aggregations, joins, outer joins.
• Trend aggregation (Hamlet, ADR-005), forecasting (prediction suffix trees).
• Contexts and parallelism, architecture/parallelism.

Scenarios and comparisons

• Scenarios — fraud, kill chains, insider trading, patient safety, predictive maintenance.
• SIEM evasion lab — four articles on detections that survive evasion.
• Comparisons — Flink, Proton, Arroyo, Kafka Streams, Esper; benchmarks.

Reference

• CLI — varpulis check, parse, simulate.
• Decision records — from the parser to the retirement of the platform.
• Specification, glossary, MSRV policy.