Real-Time CSPM Runbook: Continuous Monitoring Configuration

Your cloud environment changed 47 times in the last hour. How quickly will your security tools catch up?

Traditional CSPM scans every 6, 12, or 24 hours work for static infrastructure but are risky when developers deploy 30 times a day. Kubernetes clusters can drift between lunch and standup, or an intern might accidentally open a security group to 0.0.0.0/0 late on a Friday.

This runbook guides you through setting up continuous cloud monitoring using event-driven CSPM. You'll connect cloud-native event sources, define detection rules, and integrate remediation workflows so your team catches misconfigurations in minutes instead of waiting for the next scan cycle.

What This Configuration Does

Event-driven CSPM monitors your cloud infrastructure by subscribing to real-time change streams from AWS CloudTrail, Azure Event Hubs, and Google Cloud Audit Logs. Instead of polling APIs every few hours, the system receives notifications the moment a resource changes state, evaluates that change against your security policies, and routes findings to your remediation workflow.

This approach reduces mean time to remediation from days to minutes. When someone modifies an IAM policy, creates an S3 bucket, or updates a network security group, your CSPM platform evaluates the change immediately and correlates it with asset criticality, existing vulnerabilities, and compliance requirements.

You're not replacing periodic scans. You're adding a continuous monitoring layer for accounts and services where speed matters most.

Prerequisites

Before you configure event streaming, ensure you have:

• Cloud account access with permissions to create event subscriptions (CloudTrail trails, Event Hub namespaces, Pub/Sub topics).
• CSPM platform account with API access and connector configuration rights.
• Service principal or IAM role for your CSPM platform to authenticate against cloud APIs.
• Compliance framework mappings defined in your CSPM tool (CIS Benchmarks, NIST SP 800-146, PCI-DSS, or HIPAA controls).
• Ticketing system integration configured (Jira, ServiceNow, or equivalent) for remediation workflow routing.

Decide which cloud accounts require real-time monitoring. Not every development sandbox needs instant detection. Focus on production accounts, accounts handling regulated data, and environments with high change velocity.

The Configuration Template

AWS CloudTrail Event Streaming

{
  "TrailName": "cspm-realtime-events",
  "S3BucketName": "your-org-cloudtrail-logs",
  "IncludeGlobalServiceEvents": true,
  "IsMultiRegionTrail": true,
  "EnableLogFileValidation": true,
  "EventSelectors": [
    {
      "ReadWriteType": "All",
      "IncludeManagementEvents": true,
      "DataResources": [
        {
          "Type": "AWS::S3::Object",
          "Values": ["arn:aws:s3:::*/"]
        },
        {
          "Type": "AWS::Lambda::Function",
          "Values": ["arn:aws:lambda:*:*:function/*"]
        }
      ]
    }
  ],
  "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup",
  "CloudWatchLogsRoleArn": "arn:aws:iam::123456789012:role/CloudTrailRoleForCloudWatchLogs"
}

What each section does:

• IsMultiRegionTrail: Captures events from all AWS regions in a single trail, preventing blind spots when developers spin up resources in non-primary regions.
• EnableLogFileValidation: Ensures CloudTrail log integrity for audit purposes (required for SOC 2 CC6.1 and ISO/IEC 27001 Clause 8.15).
• DataResources: Defines which object-level API calls to capture; S3 and Lambda are common sources of misconfiguration.
• CloudWatchLogsLogGroupArn: Routes events to CloudWatch Logs, where your CSPM platform subscribes via Lambda or Kinesis.

Azure Event Hub Subscription

{
  "eventHubNamespace": "your-org-security-events",
  "eventHubName": "cspm-activity-stream",
  "consumerGroup": "$Default",
  "diagnosticSettings": {
    "name": "Send-to-EventHub",
    "logs": [
      {
        "category": "Administrative",
        "enabled": true
      },
      {
        "category": "Security",
        "enabled": true
      },
      {
        "category": "Policy",
        "enabled": true
      }
    ],
    "metrics": [
      {
        "category": "AllMetrics",
        "enabled": true
      }
    ]
  }
}

What each section does:

• diagnosticSettings: Defines which Azure Activity Log categories stream to Event Hub; Administrative and Security cover IAM changes, network modifications, and resource deletions.
• consumerGroup: Isolates your CSPM platform's event consumption from other subscribers; use dedicated groups to prevent message loss during high-volume periods.

Detection Rule Template

rule_id: exposed-storage-public-access
severity: high
cloud_provider: [aws, azure, gcp]
resource_types:
  - aws: s3_bucket
  - azure: storage_account
  - gcp: storage_bucket
conditions:
  - public_access_enabled: true
  - encryption_at_rest: false
compliance_mappings:
  - framework: PCI-DSS
    control: 3.4
  - framework: HIPAA
    control: 164.312(a)(2)(iv)
  - framework: ISO/IEC 27001
    clause: 8.11
remediation_workflow:
  auto_remediate: false
  ticket_priority: P1
  assignment_group: cloud-security
  remediation_steps:
    - "Disable public access on the storage resource"
    - "Enable encryption at rest using FIPS-Validated [Cryptography](/glossary/cryptography)"
    - "Review access logs for unauthorized access during exposure window"
    - "Document incident timeline for audit trail"

What each section does:

• conditions: Defines the logic that triggers an alert; combine multiple conditions to reduce false positives.
• compliance_mappings: Links findings to specific control requirements, generating audit-ready evidence automatically.
• auto_remediate: Set to false for high-impact changes requiring human approval; enable for low-risk fixes like tagging or log enablement.

How to Customize It

Adjust event filtering based on change velocity. If your development accounts generate 10,000 events per hour, you'll overwhelm your CSPM platform and your team. Start with production accounts and regulated workloads. Add development accounts only after you've tuned your detection rules to minimize noise.

Map detection rules to your risk appetite. The template flags unencrypted storage with public access. If your organization allows public S3 buckets for static website hosting, modify the rule to exclude buckets tagged public-website: true. Document exclusions in your risk treatment plan.

Configure remediation workflows by finding severity. Route critical findings (exposed credentials, publicly accessible databases) to your on-call rotation with P0 priority. Route informational findings (missing tags, non-compliant naming conventions) to weekly review queues. Don't make everything urgent or nothing will be.

Set compliance framework mappings during initial configuration. If you're pursuing SOC 2 Type II, map storage encryption rules to CC6.7. If you're maintaining ISO/IEC 27001 certification, link network security group changes to Clause 8.20 (networks security) and Clause 8.22 (segregation in networks). Your external auditors will ask for this mapping during the assurance engagement.

Validation Steps

After you deploy the configuration, verify it's working before you rely on it:

1. Trigger a controlled misconfiguration. In a non-production account, create an S3 bucket with public read access and no encryption. Your CSPM platform should detect this within 60 seconds and generate a finding.

2. Check event ingestion rates. Review your CSPM platform's event processing dashboard. If you're seeing 10-minute delays between CloudTrail event timestamps and detection timestamps, your event stream is backlogged. Scale your ingestion infrastructure or reduce event volume.

3. Verify compliance mapping accuracy. Pull a sample finding and confirm it references the correct control numbers. If your HIPAA findings cite PCI-DSS controls, your framework mappings are incorrect.

4. Test remediation workflow routing. Create a test finding and confirm it appears in your ticketing system with the correct priority and assignment. If tickets aren't routing properly, your integration credentials may have expired.

5. Review false positive rates weekly for the first month. Track how many findings your team marks as false positives or acceptable risk. If more than 20% of findings are noise, tighten your detection logic or expand your exclusion criteria.

Real-time monitoring compresses the window between misconfiguration and detection. That compression only matters if your team can act on findings faster than they're generated. Tune aggressively, route intelligently, and measure mean time to remediation as your primary success metric.