Streaming changes fim

[piExpr]

Seeking guidance regards to getting FIM change logged to SIEM without making use of FDR.

Rest api resource id and changes referencing id are visible. The challenge to put this streams continuously poll avoiding duplicating stream using python.

Anyone done work using filevantage-api?

Logic App seems heavy and costly while Func App is more appropriate speaking in Azure language here.

If anyone done something any help is appreciated.

[tsullivan06]

The best solutions would most likely be to use the highVolumeQueryChanges module and filter on the "action_timestamp" field.