FortiManager-pushed packet sniffer configs on multiple FortiGates (PEERSTITCH)
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Microsoft Sentinel (KQL)
