Question
Can I do this through a play book?
Can a playbook be set up to scan for configuration changes that happen during a given set of hours?
I'm struggling to see how to set it up. I know these come through as:
Event Message: Configuration changed(Configuration is changed in the admin session)
Event Severity: alert
Event Sub Type: system
Event Type: event
I'm just not seeing how to get that granuarity into the playbook. Is there another way to approach getting notifications if logs are changed overnight?