What happens after a security group changes: real-time scanning, step by step
How event-driven CSPM works on AWS: the CloudTrail event, the SIEM alert and the single-resource rescan after a security group changes, plus the limits and the scan-gap arithmetic.