CISCO-FIREPOWER-OBSERVE-MIB

All MIBs › CISCO-FIREPOWER-OBSERVE-MIB

Organization: Cisco Systems Inc.

Last Updated: 2022-08-25

Category: Cisco Devices, Hardware and Environment

Description: Provides management objects for monitoring observations, threshold events, and trending data on Cisco UCS/Firepower platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-FIREPOWER-OBSERVE-MIB?

CISCO-FIREPOWER-OBSERVE-MIB is a Cisco MIB module modeling the "OBSERVE" management information package for Cisco Firepower/UCS-managed platforms, providing objects to configure observation filters, threshold events, and trending/statistics collection. It exposes filter-table objects that define which managed-object classes and properties are being observed or filtered (by class ID, distinguished name, and property values), forming a configuration layer for Cisco's UCS-style Firepower device model. Its monitoring role is indirect: rather than exposing raw hardware counters itself, it lets an operator configure which conditions (thresholds, filtered properties) should be watched, which then drive alerts about device or security-appliance conditions elsewhere in the Firepower management model. It depends on Cisco's shared UCS/Firepower object-naming and distinguished-name-based management information model used across other Cisco Firepower MIBs. It is deployed on Cisco Firepower security appliances (and related UCS-managed chassis) where administrators need configurable observation/threshold filtering for trending and event data. Engineers can download the CISCO-FIREPOWER-OBSERVE-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-FIREPOWER-OBSERVE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Firepower security appliance
Cisco UCS-managed platform

Monitoring Examples

An administrator would inspect cfprObserveFilterTable/cfprObserveFilterEntry (indexed by cfprObserveFilterInstanceId) to review a configured filter's cfprObserveFilterDn and cfprObserveFilterFilterClassId, confirming which managed object class is being observed. Checking cfprObserveFilterFilterPropId1/cfprObserveFilterFilterPropValue1 alongside cfprObserveFilterAndOperation would reveal whether a filter is combining multiple property conditions correctly; a filter with an unexpected or empty property value would indicate a misconfigured observation rule that is silently failing to catch the intended condition.

What Can Be Monitored

observation filter configuration
filtered managed-object class
filter property conditions
filter logical operation (AND)

Imported Objects

From CISCO-FIREPOWER-MIB

CfprManagedObjectDn
CfprManagedObjectId
ciscoFirepowerMIBObjects	OBJECT-IDENTITY

From CISCO-FIREPOWER-TC-MIB

CfprConditionRemoteInvRslt
CfprFsmCompletion
CfprFsmFlags
CfprFsmFsmStageStatus
CfprMoMoClassId
CfprObserveObservedFsmCurrentFsm
CfprObserveObservedFsmStageName
CfprObserveObservedFsmTaskItem

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TC

CiscoAlarmSeverity
CiscoInetAddressMask
CiscoNetworkAddress
TimeIntervalSec
Unsigned64

From INET-ADDRESS-MIB

InetAddressIPv4
InetAddressIPv6

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Gauge32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
MacAddress
RowPointer
TEXTUAL-CONVENTION
TimeInterval
TimeStamp
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
T/F cfprObserveFilterAndOperation	1.3.6.1.4.1.9.9.826.1.57.1.1.4	TruthValue	read-only	Cisco Firepower observe:Filter:andOperation managed object property
CFP cfprObserveFilterChildClassId	1.3.6.1.4.1.9.9.826.1.57.1.1.5	CfprMoMoClassId	read-only	Cisco Firepower observe:Filter:childClassId managed object property
CFP cfprObserveFilterDn	1.3.6.1.4.1.9.9.826.1.57.1.1.2	CfprManagedObjectDn	read-only	Cisco Firepower observe:Filter:dn managed object property
cfprObserveFilterEntry	1.3.6.1.4.1.9.9.826.1.57.1.1		not-accessible	Entry for the cfprObserveFilterTable table.
CFP cfprObserveFilterFilterClassId	1.3.6.1.4.1.9.9.826.1.57.1.1.6	CfprMoMoClassId	read-only	Cisco Firepower observe:Filter:filterClassId managed object property
STR cfprObserveFilterFilterPropId1	1.3.6.1.4.1.9.9.826.1.57.1.1.7	SnmpAdminString	read-only	Cisco Firepower observe:Filter:filterPropId1 managed object property
STR cfprObserveFilterFilterPropId2	1.3.6.1.4.1.9.9.826.1.57.1.1.8	SnmpAdminString	read-only	Cisco Firepower observe:Filter:filterPropId2 managed object property
STR cfprObserveFilterFilterPropId3	1.3.6.1.4.1.9.9.826.1.57.1.1.9	SnmpAdminString	read-only	Cisco Firepower observe:Filter:filterPropId3 managed object property
STR cfprObserveFilterFilterPropValue1	1.3.6.1.4.1.9.9.826.1.57.1.1.10	SnmpAdminString	read-only	Cisco Firepower observe:Filter:filterPropValue1 managed object property
STR cfprObserveFilterFilterPropValue2	1.3.6.1.4.1.9.9.826.1.57.1.1.11	SnmpAdminString	read-only	Cisco Firepower observe:Filter:filterPropValue2 managed object property
STR cfprObserveFilterFilterPropValue3	1.3.6.1.4.1.9.9.826.1.57.1.1.12	SnmpAdminString	read-only	Cisco Firepower observe:Filter:filterPropValue3 managed object property
T/F cfprObserveFilterHierarchical	1.3.6.1.4.1.9.9.826.1.57.1.1.13	TruthValue	read-only	Cisco Firepower observe:Filter:hierarchical managed object property
CFP cfprObserveFilterInstanceId	1.3.6.1.4.1.9.9.826.1.57.1.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
T/F cfprObserveFilterReplicateIfNoChild	1.3.6.1.4.1.9.9.826.1.57.1.1.14	TruthValue	read-only	Cisco Firepower observe:Filter:replicateIfNoChild managed object property
STR cfprObserveFilterRn	1.3.6.1.4.1.9.9.826.1.57.1.1.3	SnmpAdminString	read-only	Cisco Firepower observe:Filter:rn managed object property
cfprObserveFilterTable	1.3.6.1.4.1.9.9.826.1.57.1		not-accessible	Cisco Firepower observe:Filter managed object table
cfprObserveObjects	1.3.6.1.4.1.9.9.826.1.57			MIB representation of the Cisco Firepower OBSERVE management information model package
CFP cfprObserveObservedContDn	1.3.6.1.4.1.9.9.826.1.57.3.1.2	CfprManagedObjectDn	read-only	Cisco Firepower observe:ObservedCont:dn managed object property
cfprObserveObservedContEntry	1.3.6.1.4.1.9.9.826.1.57.3.1		not-accessible	Entry for the cfprObserveObservedContTable table.
G32 cfprObserveObservedContIdCount	1.3.6.1.4.1.9.9.826.1.57.3.1.4	Gauge32	read-only	Cisco Firepower observe:ObservedCont:idCount managed object property
CFP cfprObserveObservedContInstanceId	1.3.6.1.4.1.9.9.826.1.57.3.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
STR cfprObserveObservedContRn	1.3.6.1.4.1.9.9.826.1.57.3.1.3	SnmpAdminString	read-only	Cisco Firepower observe:ObservedCont:rn managed object property
cfprObserveObservedContTable	1.3.6.1.4.1.9.9.826.1.57.3		not-accessible	Cisco Firepower observe:ObservedCont managed object table
STR cfprObserveObservedDataSrcAppType	1.3.6.1.4.1.9.9.826.1.57.2.1.4	SnmpAdminString	read-only	Cisco Firepower observe:Observed:dataSrcAppType managed object property
G32 cfprObserveObservedDataSrcSysId	1.3.6.1.4.1.9.9.826.1.57.2.1.5	Gauge32	read-only	Cisco Firepower observe:Observed:dataSrcSysId managed object property
CFP cfprObserveObservedDn	1.3.6.1.4.1.9.9.826.1.57.2.1.2	CfprManagedObjectDn	read-only	Cisco Firepower observe:Observed:dn managed object property
cfprObserveObservedEntry	1.3.6.1.4.1.9.9.826.1.57.2.1		not-accessible	Entry for the cfprObserveObservedTable table.
DAT cfprObserveObservedFsmCompletionTime	1.3.6.1.4.1.9.9.826.1.57.4.1.4	DateAndTime	read-only	Cisco Firepower observe:ObservedFsm:completionTime managed object property
CFP cfprObserveObservedFsmCurrentFsm	1.3.6.1.4.1.9.9.826.1.57.4.1.5	CfprObserveObservedFsmCurrentFsm	read-only	Cisco Firepower observe:ObservedFsm:currentFsm managed object property
STR cfprObserveObservedFsmDescr	1.3.6.1.4.1.9.9.826.1.57.2.1.6	SnmpAdminString	read-only	Cisco Firepower observe:Observed:fsmDescr managed object property
STR cfprObserveObservedFsmDescrData	1.3.6.1.4.1.9.9.826.1.57.4.1.6	SnmpAdminString	read-only	Cisco Firepower observe:ObservedFsm:descr managed object property
CFP cfprObserveObservedFsmDn	1.3.6.1.4.1.9.9.826.1.57.4.1.2	CfprManagedObjectDn	read-only	Cisco Firepower observe:ObservedFsm:dn managed object property
cfprObserveObservedFsmEntry	1.3.6.1.4.1.9.9.826.1.57.4.1		not-accessible	Entry for the cfprObserveObservedFsmTable table.
CFP cfprObserveObservedFsmFsmStatus	1.3.6.1.4.1.9.9.826.1.57.4.1.7	CfprFsmFsmStageStatus	read-only	Cisco Firepower observe:ObservedFsm:fsmStatus managed object property
CFP cfprObserveObservedFsmInstanceId	1.3.6.1.4.1.9.9.826.1.57.4.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
STR cfprObserveObservedFsmPrev	1.3.6.1.4.1.9.9.826.1.57.2.1.7	SnmpAdminString	read-only	Cisco Firepower observe:Observed:fsmPrev managed object property
G32 cfprObserveObservedFsmProgr	1.3.6.1.4.1.9.9.826.1.57.2.1.8	Gauge32	read-only	Cisco Firepower observe:Observed:fsmProgr managed object property
G32 cfprObserveObservedFsmProgress	1.3.6.1.4.1.9.9.826.1.57.4.1.8	Gauge32	read-only	Cisco Firepower observe:ObservedFsm:progress managed object property
G32 cfprObserveObservedFsmRmtErrCode	1.3.6.1.4.1.9.9.826.1.57.4.1.9	Gauge32	read-only	Cisco Firepower observe:ObservedFsm:rmtErrCode managed object property
STR cfprObserveObservedFsmRmtErrDescr	1.3.6.1.4.1.9.9.826.1.57.4.1.10	SnmpAdminString	read-only	Cisco Firepower observe:ObservedFsm:rmtErrDescr managed object property
G32 cfprObserveObservedFsmRmtInvErrCode	1.3.6.1.4.1.9.9.826.1.57.2.1.9	Gauge32	read-only	Cisco Firepower observe:Observed:fsmRmtInvErrCode managed object property
STR cfprObserveObservedFsmRmtInvErrDescr	1.3.6.1.4.1.9.9.826.1.57.2.1.10	SnmpAdminString	read-only	Cisco Firepower observe:Observed:fsmRmtInvErrDescr managed object property
CFP cfprObserveObservedFsmRmtInvRslt	1.3.6.1.4.1.9.9.826.1.57.2.1.11	CfprConditionRemoteInvRslt	read-only	Cisco Firepower observe:Observed:fsmRmtInvRslt managed object property
CFP cfprObserveObservedFsmRmtRslt	1.3.6.1.4.1.9.9.826.1.57.4.1.11	CfprConditionRemoteInvRslt	read-only	Cisco Firepower observe:ObservedFsm:rmtRslt managed object property
STR cfprObserveObservedFsmRn	1.3.6.1.4.1.9.9.826.1.57.4.1.3	SnmpAdminString	read-only	Cisco Firepower observe:ObservedFsm:rn managed object property
STR cfprObserveObservedFsmStageDescr	1.3.6.1.4.1.9.9.826.1.57.2.1.12	SnmpAdminString	read-only	Cisco Firepower observe:Observed:fsmStageDescr managed object property
STR cfprObserveObservedFsmStageDescrData	1.3.6.1.4.1.9.9.826.1.57.5.1.4	SnmpAdminString	read-only	Cisco Firepower observe:ObservedFsmStage:descr managed object property
CFP cfprObserveObservedFsmStageDn	1.3.6.1.4.1.9.9.826.1.57.5.1.2	CfprManagedObjectDn	read-only	Cisco Firepower observe:ObservedFsmStage:dn managed object property
cfprObserveObservedFsmStageEntry	1.3.6.1.4.1.9.9.826.1.57.5.1		not-accessible	Entry for the cfprObserveObservedFsmStageTable table.
CFP cfprObserveObservedFsmStageInstanceId	1.3.6.1.4.1.9.9.826.1.57.5.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
DAT cfprObserveObservedFsmStageLastUpdateTime	1.3.6.1.4.1.9.9.826.1.57.5.1.5	DateAndTime	read-only	Cisco Firepower observe:ObservedFsmStage:lastUpdateTime managed object property
CFP cfprObserveObservedFsmStageName	1.3.6.1.4.1.9.9.826.1.57.5.1.6	CfprObserveObservedFsmStageName	read-only	Cisco Firepower observe:ObservedFsmStage:name managed object property
G32 cfprObserveObservedFsmStageOrder	1.3.6.1.4.1.9.9.826.1.57.5.1.7	Gauge32	read-only	Cisco Firepower observe:ObservedFsmStage:order managed object property
G32 cfprObserveObservedFsmStageRetry	1.3.6.1.4.1.9.9.826.1.57.5.1.8	Gauge32	read-only	Cisco Firepower observe:ObservedFsmStage:retry managed object property
STR cfprObserveObservedFsmStageRn	1.3.6.1.4.1.9.9.826.1.57.5.1.3	SnmpAdminString	read-only	Cisco Firepower observe:ObservedFsmStage:rn managed object property
CFP cfprObserveObservedFsmStageStageStatus	1.3.6.1.4.1.9.9.826.1.57.5.1.9	CfprFsmFsmStageStatus	read-only	Cisco Firepower observe:ObservedFsmStage:stageStatus managed object property
cfprObserveObservedFsmStageTable	1.3.6.1.4.1.9.9.826.1.57.5		not-accessible	Cisco Firepower observe:ObservedFsmStage managed object table
DAT cfprObserveObservedFsmStamp	1.3.6.1.4.1.9.9.826.1.57.2.1.13	DateAndTime	read-only	Cisco Firepower observe:Observed:fsmStamp managed object property
STR cfprObserveObservedFsmStatus	1.3.6.1.4.1.9.9.826.1.57.2.1.14	SnmpAdminString	read-only	Cisco Firepower observe:Observed:fsmStatus managed object property
cfprObserveObservedFsmTable	1.3.6.1.4.1.9.9.826.1.57.4		not-accessible	Cisco Firepower observe:ObservedFsm managed object table
CFP cfprObserveObservedFsmTaskCompletion	1.3.6.1.4.1.9.9.826.1.57.6.1.4	CfprFsmCompletion	read-only	Cisco Firepower observe:ObservedFsmTask:completion managed object property
CFP cfprObserveObservedFsmTaskDn	1.3.6.1.4.1.9.9.826.1.57.6.1.2	CfprManagedObjectDn	read-only	Cisco Firepower observe:ObservedFsmTask:dn managed object property
cfprObserveObservedFsmTaskEntry	1.3.6.1.4.1.9.9.826.1.57.6.1		not-accessible	Entry for the cfprObserveObservedFsmTaskTable table.
CFP cfprObserveObservedFsmTaskFlags	1.3.6.1.4.1.9.9.826.1.57.6.1.5	CfprFsmFlags	read-only	Cisco Firepower observe:ObservedFsmTask:flags managed object property
CFP cfprObserveObservedFsmTaskInstanceId	1.3.6.1.4.1.9.9.826.1.57.6.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
CFP cfprObserveObservedFsmTaskItem	1.3.6.1.4.1.9.9.826.1.57.6.1.6	CfprObserveObservedFsmTaskItem	read-only	Cisco Firepower observe:ObservedFsmTask:item managed object property
STR cfprObserveObservedFsmTaskRn	1.3.6.1.4.1.9.9.826.1.57.6.1.3	SnmpAdminString	read-only	Cisco Firepower observe:ObservedFsmTask:rn managed object property
G32 cfprObserveObservedFsmTaskSeqId	1.3.6.1.4.1.9.9.826.1.57.6.1.7	Gauge32	read-only	Cisco Firepower observe:ObservedFsmTask:seqId managed object property
cfprObserveObservedFsmTaskTable	1.3.6.1.4.1.9.9.826.1.57.6		not-accessible	Cisco Firepower observe:ObservedFsmTask managed object table
G32 cfprObserveObservedFsmTry	1.3.6.1.4.1.9.9.826.1.57.2.1.15	Gauge32	read-only	Cisco Firepower observe:Observed:fsmTry managed object property
G32 cfprObserveObservedGenNum	1.3.6.1.4.1.9.9.826.1.57.2.1.16	Gauge32	read-only	Cisco Firepower observe:Observed:genNum managed object property
T/F cfprObserveObservedHierarchical	1.3.6.1.4.1.9.9.826.1.57.2.1.17	TruthValue	read-only	Cisco Firepower observe:Observed:hierarchical managed object property
G32 cfprObserveObservedId	1.3.6.1.4.1.9.9.826.1.57.2.1.18	Gauge32	read-only	Cisco Firepower observe:Observed:id managed object property
CFP cfprObserveObservedInstanceId	1.3.6.1.4.1.9.9.826.1.57.2.1.1	CfprManagedObjectId	not-accessible	Instance identifier of the managed object.
T/F cfprObserveObservedIsDeleted	1.3.6.1.4.1.9.9.826.1.57.2.1.19	TruthValue	read-only	Cisco Firepower observe:Observed:isDeleted managed object property
STR cfprObserveObservedObservedDn	1.3.6.1.4.1.9.9.826.1.57.2.1.20	SnmpAdminString	read-only	Cisco Firepower observe:Observed:observedDn managed object property
STR cfprObserveObservedRn	1.3.6.1.4.1.9.9.826.1.57.2.1.3	SnmpAdminString	read-only	Cisco Firepower observe:Observed:rn managed object property
cfprObserveObservedTable	1.3.6.1.4.1.9.9.826.1.57.2		not-accessible	Cisco Firepower observe:Observed managed object table

RFC description

Cisco Firepower security appliance observation and monitoring of FSM task execution.

Start monitoring Cisco Firepower security appliance / UCS-managed platform with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-FIREPOWER-OBSERVE-MIB

What Is CISCO-FIREPOWER-OBSERVE-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description