Title:
Cisco Sniffing
Status:
test
Description:Show when a monitor or a span/rspan is setup or modified
References:
Author: Austin Clark
Date: 2019-08-11
modified:2023-01-04
Tags:
- -'attack.credential-access'
- -'attack.discovery'
- -'attack.t1040'
Logsource:
- product: cisco
- service: aaa
Detection:
keywords:
- 'monitor capture point'
- 'set span'
- 'set rspan'
condition:
keywords
Falsepositives:
-Admins may setup new or modify old spans, or use a monitor for troubleshooting
Level:
medium
