Content changes are not displayed from Tripwire feeds in Splunk. Real time monitoring has been enabled on the TE console to detect changes on the TE nodes, Splunk is able to retrieve the policy violation logs from tripwire by initiating the rest api call, the only information missing is the 'content that was changed'. IS there a setting or a way to detect content changes on the tripwire feeds.
Please let me know,I am using rest API calls to retrieve changes on the tripwire agents captured by the tripwire management console. Real time monitoring has been enabled on TE console to detect changes on the TE nodes in real time. We are getting tripwire policy change events in Splunk, but we do not see what content was changed on a file or the object. IS there a way content changes can be displayed in Splunk from Tripwire feeds.
Please let me know.
