LoFP / administrator disabling pim alerts as an active choice.

Techniques

• t1078

Sample rules

PIM Alert Setting Changes To Disabled

• source: sigma
• technicques:
  • t1078

Description

Detects when PIM alerts are set to disabled.

Detection logic

condition: selection
selection:
  properties.message: Disable PIM Alert