All MIBs › ANTIVIRUS-MIB
Category: VPN and Security
Description: Antivirus and anti-malware engine status, signature version, and scan result reporting via SNMP.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is ANTIVIRUS-MIB?
ANTIVIRUS-MIB (associated with McAfee/NAI object naming) is a vendor-oriented MIB used by antivirus and anti-malware agents to report scan events, infection detections, and engine/signature status via SNMP traps. It exposes fault/event data such as the infected file path, virus name, triggering user account, scan task name, and the antivirus engine's operating system context. Its monitoring value is entirely software status-focused: reporting real-time infection detections, scan task outcomes, and crucially the antivirus engine version and DAT (signature) version, which reveal whether protection is current or stale. It has no apparent formal dependency on other MIBs beyond standard SNMP trap conventions. It is deployed on endpoints, servers, or gateway appliances running antivirus software that reports status via SNMP, with ANTIVIRUS-MIB SNMP monitoring commonly used in enterprise security environments to centralize endpoint protection visibility.
IPNetwork Monitor allows you to monitor SNMP objects defined in ANTIVIRUS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- endpoints/servers running antivirus agents
- security gateway appliances
Monitoring Examples
A security operations console would subscribe to naiAntiVirus traps and inspect naiAntiVirusTrapInfectedFile, naiAntiVirusTrapVirusName, and naiAntiVirusTrapAgentUser to identify what was infected, by which malware, and under which user context. Checking naiAntiVirusTrapEngineVersion and naiAntiVirusTrapDATVersion across many hosts reveals endpoints running outdated signature databases that need an update push, while naiAntiVirusTrapStatus and naiAntiVirusTrapTaskName show whether a scheduled scan task completed cleanly or failed.
What Can Be Monitored
- infected file detections
- virus/malware name
- triggering user account
- scan task status
- antivirus engine version
- signature (DAT) version
Imported Objects
From NAI-MIB
| nai | OBJECT-IDENTITY |
| naiTrapAgent | OBJECT-TYPE |
| naiTrapAgentVersion | OBJECT-TYPE |
| naiTrapAlarmSourceAddress | OBJECT-TYPE |
| naiTrapAlarmSourceDNSName | OBJECT-TYPE |
| naiTrapDescription | OBJECT-TYPE |
| naiTrapGMTTime | OBJECT-TYPE |
| naiTrapLocalTime | OBJECT-TYPE |
| naiTrapPseudoID | OBJECT-TYPE |
| naiTrapSeverity | OBJECT-TYPE |
| naiTrapURL | OBJECT-TYPE |
From RFC-1215
| TRAP-TYPE |
From RFC1155-SMI
| OBJECT-TYPE |
OIDs
RFC description
Tracks antivirus alert information including infected files, virus detection, user accounts, and scanning engine status for security monitoring.
Start monitoring McAfee (NAI) antivirus-managed endpoints/servers/gateways with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.