It was handled by internal security team. Also, tripwire was limited to periodically scanning files, couldn't scan for example syscalls and trace relationships

It was handled by internal security team. Also, tripwire was limited to periodically scanning files, couldn't scan for example syscalls and trace relationships between them. But yes, tripwire is a very early EDR/XDR.