Aqua CSPM is divided into two main functionalities:

• Scanning
• Event Monitoring

Scanning occurs via a pull model; CSPM queries your cloud account APIs to obtain information about resources at that point in time.

Real-Time Events occur via a push model; CSPM connects to event streams to receive a continuous stream of activity occurring in the account, which it evaluates for security risks.

For complete documentation, see Real-Time Events Overview on the Aqua Platform Documentation Portal.