AWS EventBridge Delta Sync

The AWS EventBridge Delta Sync ingests AWS resource change events into Qualys TotalCloud using Amazon EventBridge. In the next scheduled connector run, the Delta Sync identifies resources that have changed since the last execution, rather than scanning your entire AWS environment, leading to faster inventory updates and more efficient evaluation cycles.

What is AWS EventBridge Delta Sync?

AWS EventBridge captures management events from AWS CloudTrail and forwards them to TotalCloud. When Delta Sync is enabled, TotalCloud uses these events to determine which resource types have changed and limits inventory and evaluation runs to only those resource types. Resource deletions are processed immediately upon receipt of the deletion event.

A full scan of the entire AWS environment runs automatically every 48 hours to ensure consistency. Manual connector runs always perform a full scan regardless of the Delta Sync setting.

Delta Sync requires a one-time deployment of a Qualys-provided CloudFormation Template (CFT) in your AWS environment before activation.

Configure the EventBridge Delta Sync

To configure the EventBridge Delta Sync, you must deploy the CloudFormation Template and then select the EventBridge Delta Sync in the Connector configuration wizard.

Read more about How to Configure the EventBridge Delta Sync.

How Delta Sync Works

Delta Sync reduces connector run time by scoping inventory and evaluation to only the resource types that have changed. The diagram below shows how the changed resource data is passed to Qualys TotalCloud.

The following section describes how different change types are handled.

Resource Deletions

 If you opt for the delta sync option, resource deletion in the TotalCloud inventory/posture will occur in real-time.

Resource Modifications

At each configured Delta Sync interval, TotalCloud:

1. Identifies which resource types have received change events since the last run.
2. Runs inventory and evaluation for those resource types only in respective regions only 
3. Skips all resource types with no recorded changes.

Updates operate at the resource type level, not the individual resource level. For example, if an  SNS topic is modified in us-east-1, TotalCloud refreshes all SNS topics in the respective region in inventory and posture, but does not process RDS, Lambda, or other unchanged resource types.

Critical Resources

Certain resource types are evaluated on every connector run regardless of whether a change event was received. This ensures TotalCloud maintains current data for the most security-sensitive resource types. See the Resource Compatibility Matrix for resources marked Runs In Every Conn.

Full Sync

A complete inventory and evaluation scan of all resources runs automatically every 48 hours. This ensures that any events missed or delayed by AWS do not result in stale data.

Manual Runs

A manually triggered connector run always performs a full scan. Inventory and evaluation run for all resource types regardless of the Delta Sync configuration.

Exception Handling

When Delta Sync is enabled, exception processing operates in real time. Changes to exceptions (create, update, or delete) take effect immediately without waiting for the next scheduled connector run.

CIEM and Insights

Delta Sync does not affect CIEM or Insights processing. Both continue to operate on their standard schedules.

Resource Compatibility Matrix

View which AWS resources are supported for EventBridge Delta Sync. View the matrix.