Hi all,
After modifying Trend Micro Vision One integration (setting 'preserve_original_event') and restarting the agent, what can I do to make the change effective?
Thanks a lot!
When you deactivate the option and apply the change it is supposed to be effective immediately, after the change the field called “event.original” which contains a copy of the original log will no longer arrive.
If for some reason the change does not take effect, I recommend you to check the agent logs regarding the integration to determine if there are errors or if it is in an unhealthy state.
1 Like