LoFP / admins may setup new or modify old spans, or use a monitor for troubleshooting

Techniques

• t1040

Sample rules

Cisco Sniffing

• source: sigma
• technicques:
  • t1040

Description

Show when a monitor or a span/rspan is setup or modified

Detection logic

condition: keywords
keywords:
- monitor capture point
- set span
- set rspan