TPT-NGFW-POLICY-MIB
50 objects
Policy information and notifications for TippingPoint Next-Generation Firewall products. This includes Firewall rules, IPS, Reputation profiles, Quarantine. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
Imported Objects
| INET-ADDRESS-MIB | InetAddress InetAddressType |
| SNMP-FRAMEWORK-MIB | SnmpAdminString |
| SNMPv2-CONF | MODULE-COMPLIANCE NOTIFICATION-GROUP OBJECT-GROUP |
| SNMPv2-SMI | Counter64 MODULE-IDENTITY NOTIFICATION-TYPE OBJECT-TYPE Unsigned32 |
| SNMPv2-TC | DateAndTime TEXTUAL-CONVENTION |
| TPT-NGFW-REG-MIB | tpt-ngfw-compls tpt-ngfw-eventsV2 tpt-ngfw-groups tpt-ngfw-objs tpt-ngfw-params |
| TPT-NGFW-SYSTEM-INFO-MIB | tptNgfwSystemSerial |
| OID | Name | Access | Status | Description |
|---|---|---|---|---|
| 1.3.6.1.4.1.10734.3.9.1.1.7 | GrouptptNgfwPolicyGroup | current | Policy group consisting of firewall, IPS, Reputation, and Quarantine information. | |
| 1.3.6.1.4.1.10734.3.9.1.1.8 | GrouptptNgfwPolicyNotificationGroup | current | Notification sent from TippingPoint Next-generation Firewall rules and inspection profiles. | |
| 1.3.6.1.4.1.10734.3.9.1.2.4 | CompliancetptNgfwPolicyCompl | current | Compliance for TippingPoint Next-generation Firewall policies. | |
| 1.3.6.1.4.1.10734.3.9.2.4 | IdentitytptNgfwPolicy | Policy information and notifications for TippingPoint Next-Generation Firewall products. This includes Firewall rules, IPS, Reputation profiles, Quarantine. Co… | ||
| 1.3.6.1.4.1.10734.3.9.3.0.10 | NotificationtptNgfwPolicyNotify | current | A notification sent when a firewall rule, IPS, Reputation, or Quarantine profile detects a network event of interest. | |
| 1.3.6.1.4.1.10734.3.9.3.1.20 | ScalartptNgfwPolicyNotifyTime | accessible-for-notify | current | The time when the firewall detected a network event and generated this policy notification. |
| 1.3.6.1.4.1.10734.3.9.3.1.21 | ScalartptNgfwPolicyNotifyEventSource | accessible-for-notify | current | The policy component (Firewall, IPS, Reputation, Quarantine) that detected a network event and generated this notification. |
| 1.3.6.1.4.1.10734.3.9.3.1.22 | ScalartptNgfwPolicyNotifyEventType | accessible-for-notify | current | If the notify event was generated by the firewall, this object indicates what type of event was detected. |
| 1.3.6.1.4.1.10734.3.9.3.1.23 | ScalartptNgfwPolicyNotifyEventSeverity | accessible-for-notify | current | The severity of the detected network event. |
| 1.3.6.1.4.1.10734.3.9.3.1.24 | ScalartptNgfwPolicyNotifyCorrelationId | accessible-for-notify | current | A 128-bit identifier in decimal format. This ID is used to correlate firewall events. For example, a firewall session started and ended notification will have … |
| 1.3.6.1.4.1.10734.3.9.3.1.25 | ScalartptNgfwPolicyNotifyActionType | accessible-for-notify | current | The type of action taken on network traffic matching a firewall rule or inspection profile. |
| 1.3.6.1.4.1.10734.3.9.3.1.26 | ScalartptNgfwPolicyNotifyAction | accessible-for-notify | current | This object provides additional description of a firewall action. For example, when a quarantine action occurs, this object details if the action was to place … |
| 1.3.6.1.4.1.10734.3.9.3.1.27 | ScalartptNgfwPolicyNotifyActionSetName | accessible-for-notify | current | The action set name associated with the firewall rule that detected an event. |
| 1.3.6.1.4.1.10734.3.9.3.1.28 | ScalartptNgfwPolicyNotifyRuleName | accessible-for-notify | current | The firewall rule name that has generated the notification. |
| 1.3.6.1.4.1.10734.3.9.3.1.29 | ScalartptNgfwPolicyNotifyInInterface | accessible-for-notify | current | The interface name that is receiving the traffic that triggered a firewall action. |
| 1.3.6.1.4.1.10734.3.9.3.1.30 | ScalartptNgfwPolicyNotifyOutInterface | accessible-for-notify | current | The interface name sending the suspect traffic. |
| 1.3.6.1.4.1.10734.3.9.3.1.31 | ScalartptNgfwPolicyNotifySrcIpAddrType | accessible-for-notify | current | The IP address type of the network traffic source. |
| 1.3.6.1.4.1.10734.3.9.3.1.32 | ScalartptNgfwPolicyNotifySrcIpAddr | accessible-for-notify | current | The source IP address generating the network traffic that has triggered a firewall action. |
| 1.3.6.1.4.1.10734.3.9.3.1.33 | ScalartptNgfwPolicyNotifySrcPort | accessible-for-notify | current | The source port generating the network traffic. |
| 1.3.6.1.4.1.10734.3.9.3.1.34 | ScalartptNgfwPolicyNotifySrcTransIpAddr | accessible-for-notify | current | The translated (NAT) source IP address. |
| 1.3.6.1.4.1.10734.3.9.3.1.35 | ScalartptNgfwPolicyNotifySrcTransPort | accessible-for-notify | current | The translated (NAT) source port. |
| 1.3.6.1.4.1.10734.3.9.3.1.36 | ScalartptNgfwPolicyNotifyDestIpAddrType | accessible-for-notify | current | The destination IP address type. |
| 1.3.6.1.4.1.10734.3.9.3.1.37 | ScalartptNgfwPolicyNotifyDestIpAddr | accessible-for-notify | current | The source IP address receiving network traffic that triggered a firewall action. |
| 1.3.6.1.4.1.10734.3.9.3.1.38 | ScalartptNgfwPolicyNotifyDestPort | accessible-for-notify | current | The source port receiving the network traffic. |
| 1.3.6.1.4.1.10734.3.9.3.1.39 | ScalartptNgfwPolicyNotifyDestTransIpAddr | accessible-for-notify | current | The translated (NAT) destination IP address. |
| 1.3.6.1.4.1.10734.3.9.3.1.40 | ScalartptNgfwPolicyNotifyDestTransPort | accessible-for-notify | current | The translated (NAT) destination port. |
| 1.3.6.1.4.1.10734.3.9.3.1.41 | ScalartptNgfwPolicyNotifyProtocol | accessible-for-notify | current | The transport protocol of the suspect traffic. |
| 1.3.6.1.4.1.10734.3.9.3.1.42 | ScalartptNgfwPolicyNotifyApplicationName | accessible-for-notify | current | The application name generating network traffic that has triggered a firewall rule. |
| 1.3.6.1.4.1.10734.3.9.3.1.43 | ScalartptNgfwPolicyNotifyUserName | accessible-for-notify | current | The user name, if available, that is responsible for generating network traffic triggering a firewall action. |
| 1.3.6.1.4.1.10734.3.9.3.1.44 | ScalartptNgfwPolicyNotifyBytesIn | accessible-for-notify | current | Source to destination bytes. |
| 1.3.6.1.4.1.10734.3.9.3.1.45 | ScalartptNgfwPolicyNotifyBytesOut | accessible-for-notify | current | Destination to source bytes. |
| 1.3.6.1.4.1.10734.3.9.3.1.46 | ScalartptNgfwPolicyNotifyStartTimeSec | accessible-for-notify | current | The time, in seconds, from EPOC (January 1, 1970 00:00:00) when the event was detected. |
| 1.3.6.1.4.1.10734.3.9.3.1.47 | ScalartptNgfwPolicyNotifyStartTimeNano | accessible-for-notify | current | The fractional time, in nanoseconds, when the event was detected. |
| 1.3.6.1.4.1.10734.3.9.3.1.48 | ScalartptNgfwPolicyNotifyRateLimit | accessible-for-notify | current | The rate-limit, in kbps, of the action set associated with this notification. |
| 1.3.6.1.4.1.10734.3.9.3.1.49 | ScalartptNgfwPolicyNotifyPktTraceVer | accessible-for-notify | current | The packet trace version. |
| 1.3.6.1.4.1.10734.3.9.3.1.50 | ScalartptNgfwPolicyNotifyPktTraceId | accessible-for-notify | current | The bucket identifier for a packet trace. |
| 1.3.6.1.4.1.10734.3.9.3.1.51 | ScalartptNgfwPolicyNotifyPktTraceBegin | accessible-for-notify | current | The starting sequence number for a packet trace. |
| 1.3.6.1.4.1.10734.3.9.3.1.52 | ScalartptNgfwPolicyNotifyPktTraceEnd | accessible-for-notify | current | The ending sequence number for a packet trace. |
| 1.3.6.1.4.1.10734.3.9.3.1.53 | ScalartptNgfwPolicyNotifyFilterName | accessible-for-notify | current | The descriptive name of the filter maching the data stream. |
| 1.3.6.1.4.1.10734.3.9.3.1.54 | ScalartptNgfwPolicyNotifyProfileName | accessible-for-notify | current | Profile name. |
| 1.3.6.1.4.1.10734.3.9.3.1.55 | ScalartptNgfwPolicyNotifyPolicyName | accessible-for-notify | current | The firewall policy name that matched network traffic and caused the firewall to take an action. |
| 1.3.6.1.4.1.10734.3.9.3.1.56 | ScalartptNgfwPolicyNotifyVlanId | accessible-for-notify | current | The VLAN tag that the network traffic occured on. |
| 1.3.6.1.4.1.10734.3.9.3.1.57 | ScalartptNgfwPolicyNotifyHitCount | accessible-for-notify | current | Hit count. The number of times, the firewall detected a particulare event as defined by a rule or inspection profile. |
| 1.3.6.1.4.1.10734.3.9.3.1.58 | ScalartptNgfwPolicyNotifyMsgParams | accessible-for-notify | current | A string containing parameters (separated by vertical bars) matching the Message in the Digital Vaccine (the XML tag is Message). |
| 1.3.6.1.4.1.10734.3.9.3.1.59 | ScalartptNgfwPolicyNotifyPeriod | accessible-for-notify | current | The aggregation period, in minutes, when the condition is frist detected and this notification sent. |
Type Definitions
| Name | Syntax | Status | Description |
|---|---|---|---|
| ActionType | INTEGER { permit(1), rateLimit(2), trust(3), block(4), quarantine(5) } | current | The action taken by a policy to either block, permit, trust, rate-limit, or quarantine network traffic. |
| EventSeverity | INTEGER { info(1), low(2), minor(3), major(4), critical(5) } | current | The severity of a network event. |
| EventSource | INTEGER { firewall(1), ips(2), reputation(3), quarantine(4) } | current | The firewall rule or inspection profile that triggered a policy notification. |
| FirewallEventType | INTEGER { sessionStart(1), applicationDetect(2), sessionEnd(3), blockedByFirewall(4) } | current | The type of firewall event detected: a session start or end, an application detection, or network traffic was blocked. |
| PacketTraceVersion | INTEGER { packetTraceV1(1), packetTraceV2(2), none(3) } | current | The version of a packet trace collected and saved or none. |