AVQUARANTINE-STATISTICS-MIB

All MIBs › AVQUARANTINE-STATISTICS-MIB

Organization: www.kaspersky.com

Last Updated: 2016-02-24

Category: VPN and Security, Vendor: Kaspersky

Description: Provides Kaspersky AntiVirus quarantine statistics, tracking the number of quarantined objects and quarantine storage usage.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is AVQUARANTINE-STATISTICS-MIB?

AVQUARANTINE-STATISTICS-MIB is a vendor-specific MIB from Kaspersky Lab exposing antivirus quarantine statistics for its security software/appliance products. It reports counters for the number of objects currently held in quarantine and quarantine storage usage, tracked as of the current statistics period. Its monitoring emphasis is on security-software operational status rather than physical hardware: administrators use it to track how actively the antivirus engine is isolating suspicious/infected objects and whether quarantine storage is approaching capacity, which if left unmonitored could cause the antivirus service to stop quarantining new threats. It is a self-contained vendor MIB with no apparent dependency on other standard security MIBs. It is deployed on servers or gateway appliances running Kaspersky Anti-Virus software, in enterprise environments needing SNMP-based visibility into endpoint/gateway security software health. Network engineers evaluating or troubleshooting this functionality can download the AVQUARANTINE-STATISTICS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in AVQUARANTINE-STATISTICS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

server or gateway appliance running Kaspersky Anti-Virus software

Monitoring Examples

An administrator would poll the quarantine object-count and storage-usage counters to see how many files Kaspersky has quarantined in the current period and how much quarantine disk space is consumed, alerting if the count spikes (indicating a malware outbreak) or storage usage nears its limit. A sudden jump in the quarantined-object count combined with high storage usage would reveal an active malware incident overwhelming the antivirus quarantine capacity.

What Can Be Monitored

number of quarantined objects
quarantine storage usage
quarantine statistics for current period

Imported Objects

From KAV4FS-STATISTICS-MIB

statistics

MODULE-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
TimeStamp

How to Use in IPNetwork Monitor

Example using avQuarantineStatisticsObjectsInQuarantine OID:

Select a Kaspersky Anti-Virus servers/gateway as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type avQuarantineStatisticsObjectsInQuarantine into the Find box to locate it in the OID tree, then select it and click OK. The current number of objects held in quarantine by the antivirus engine. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
avQuarantineStatistics	1.3.6.1.4.1.23668.1046.2.6			Quarantine statistics till current time period
C64 avQuarantineStatisticsObjectsInQuarantineEx	1.3.6.1.4.1.23668.1046.2.6.1	Counter64	read-only
C64 avQuarantineStatisticsAutoSavedObjects	1.3.6.1.4.1.23668.1046.2.6.2	Counter64	read-only
C64 avQuarantineStatisticsManualySavedObjects	1.3.6.1.4.1.23668.1046.2.6.3	Counter64	read-only
C64 avQuarantineStatisticsRestoredObjects	1.3.6.1.4.1.23668.1046.2.6.4	Counter64	read-only
C64 avQuarantineStatisticsRemovedObjects	1.3.6.1.4.1.23668.1046.2.6.5	Counter64	read-only
C64 avQuarantineStatisticsInfectedObjects	1.3.6.1.4.1.23668.1046.2.6.6	Counter64	read-only
C64 avQuarantineStatisticsRiskwareObjects	1.3.6.1.4.1.23668.1046.2.6.7	Counter64	read-only
C64 avQuarantineStatisticsSuspiciousObjects	1.3.6.1.4.1.23668.1046.2.6.8	Counter64	read-only
C64 avQuarantineStatisticsCurableObjects	1.3.6.1.4.1.23668.1046.2.6.9	Counter64	read-only
C64 avQuarantineStatisticsPasswordProtectedObjects	1.3.6.1.4.1.23668.1046.2.6.10	Counter64	read-only
C64 avQuarantineStatisticsCorruptedObjects	1.3.6.1.4.1.23668.1046.2.6.11	Counter64	read-only
C64 avQuarantineStatisticsFalseDetectedObjects	1.3.6.1.4.1.23668.1046.2.6.12	Counter64	read-only

RFC description

Monitors and reports statistics for quarantined objects in Kaspersky antivirus systems, including counts of saved, restored, and removed items.

Start monitoring Kaspersky Anti-Virus servers/gateways with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download AVQUARANTINE-STATISTICS-MIB