Embedded NATS JetStream

1SEC is event-driven. The embedded NATS JetStream bus provides durable streams for events, alerts, responses, and (optionally) Rust match results.

• sec.events.> — canonical events
• sec.alerts.> — alerts emitted by modules
• sec.responses.> — enforcement audit trail
• sec.matches.> — Rust engine matches (optional)

JetStream streams are configured with retention, max bytes, and durable consumers. This lets you restart the engine without losing in-flight events.

Embedded mode starts NATS in-process. You can also point 1SEC at an external NATS server.

bus:
  embedded: true
  url: "nats://127.0.0.1:4222"
  data_dir: "./data/nats"

For very high volume deployments, tune stream limits and pair with the cold archive for long retention.

• Event routing
• Cold archive
• Docs: architecture