Cisco Network Sniffing Configuration
This rule detects when a monitor, SPAN (Switched Port Analyzer), or RSPAN (Remote Switched Port Analyzer) is configured or modified on a Cisco network device. These configurations are often used for network sniffing or traffic analysis, which can be legitimate for troubleshooting but also abused by adversaries for data exfiltration or reconnaissance.
Sigma
