From 3e1b445765acb174d9f97ec04eac4e7205f7ae1b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 12 Nov 2020 11:58:04 +0100 Subject: [PATCH] Update detect_traffic_mirroring.yml --- detections/network/detect_traffic_mirroring.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml index 42e100da1f..c35150a815 100644 --- a/detections/network/detect_traffic_mirroring.yml +++ b/detections/network/detect_traffic_mirroring.yml @@ -17,7 +17,7 @@ OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") | stats min(_time) AS firstTime max(_time) AS lastTime count - BY host + BY host facility mnemonic | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `detect_traffic_mirroring_filter`' known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators.