[ThreatSystems]

Call me dumb - I'll take it! But if we really are trying to keep it simple simple...

Then you just query from event_receiver_svcX side, for events published > datetime and event_receiver_svcX = FALSE. Once read set to TRUE.

To mitigate too many active connections have a polling / backoff strategy and place a proxy infront of the actual database to proactively throttle where needed.

But event table:

| event_id | event_msg_src | event_msg | event_msg_published | event_receiver_svc1 | event_receiver_svc2 | event_receiver_svc3 |

|----------|---------------|---------------------|---------------------|---------------------|---------------------|---------------------|

| evt01 | svc1 | json_message_format | datetime | TRUE | TRUE | FALSE |