Event Driven Sensor deployment

[jmckenzie-cs]

Instead of a scheduled scan for unprotected instances can an event-based method be used? When new instance comes online it will be detected and checked for the Falcon Sensor. If the sensor is not present it will get deployed to that instance

[ffalor]

It is possible to use event bridge to trigger the automation document, so it should be possible.

Event bridge rule listens for new instances, and when a new instance is created it calls the automation document.

I don't have an have an example of this, but in theory it should work.