Hello,
Actually, Secure Endpoint has to perform both actions.
It pulls in new data, such as Cloud dispositions, New definitions, new signatures, new versions, etc.
And also, push data, as it sends information to the cloud such as events, files that are meant to be fetched, etc.