Correct, that is for intrusion events. My tripwire events are also working. Screen shot of that rule attached. I can't remember if that's a default rule or I modified it though sorry.
This might also be relevant. In my IVS rule config:
Tripwire, I have target filters turned off and direction...