What happens after a security group changes: real-time scanning, step by step
How event-driven CSPM works on AWS: the CloudTrail event, the SIEM alert and the single-resource rescan after a security group changes, plus the limits and the scan-gap arithmetic.
CloudTrail Data Events: What to Turn On, and What it Costs You to Leave Off
Which CloudTrail data events are worth paying for, in what order, how to avoid a logging loop, and the Bedrock agent events most teams have not enabled.