Cloud Configuration

Connect each account or cluster before enabling Cloud Audits. Configure AWS, GCP, Azure cloud, or Kubernetes separately; credentials and scope do not transfer automatically between providers.

Verify scope

Record the account or subscription, its environment classification, and the intended regions or clusters. Test each connection and inspect the collected inventory. A successful credential test does not establish that every resource category is readable.

Cloud audits follow collected inventory on the configured cadence. Use POST /cspm/scans/start for an on-demand run and inspect scan status before interpreting an empty result. An absent, failed, or skipped collection is not a clean audit.

Handle findings

Use allowlist/unallowlist for an accepted exception, archive/unarchive for lifecycle organization, and the false-positive action when the finding is incorrect. Preserve the reason for the decision. Ticket deletion removes a tracking artifact; it does not repair the cloud resource.

Supported cloud autofix proposes an infrastructure-as-code change. Follow its status, state, and activity, then review the plan and resulting PR. Do not assume every cloud finding has a corresponding source change.

See the Cloud Audits API for the service's actual routes and notification settings for delivery.