FE-FIREEYE-MIB

All MIBs › FE-FIREEYE-MIB

Organization: FireEye, Inc.

Last Updated: 2014-04-07

Category: Domain: Security, VPN and Security

Description: FireEye network security appliance MIB providing management objects for threat detection events and appliance operational status.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FE-FIREEYE-MIB?

FE-FIREEYE-MIB is FireEye Inc.'s proprietary MIB for its network security/threat-detection appliances, exposing software version information and a table of detected security events. It exposes software version data (lmsVersion) and a security event log capturing event type, timestamp, trace ID, and source/destination IP addresses for detected threats. In monitoring terms this MIB is used primarily to track software status via lmsVersion and to surface security event/fault data — an admin can poll eventCount and the eventTable to detect new malware/threat detections in near real time, functioning like a fault/alarm feed rather than hardware health telemetry. There is no apparent strong dependency on other standard MIBs beyond the base SNMPv2-SMI/NOTIFICATION-TYPE conventions used to define its notifications subtree. It is deployed on FireEye network security appliances (malware/threat detection sensors) placed inline or out-of-band in enterprise networks to monitor for advanced threats. Engineers can download the FE-FIREEYE-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FE-FIREEYE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

FireEye network security/threat-detection appliance

Monitoring Examples

An admin would poll eventCount alongside eventTable/eventEntry to detect newly logged security events, then read eventType, eventSrcIp, and eventDstIp from the entry indexed by eventIndex to identify the nature and endpoints of a detected threat. Checking eventDate/eventTime and eventTraceId lets the admin correlate a FireEye-flagged event with logs from other security tools using the same trace ID. A sudden spike in eventCount over a short polling interval would indicate an active malware outbreak or attack campaign being detected by the appliance.

What Can Be Monitored

security event count
event type/ID per detection
event source and destination IP
event timestamp and trace ID
appliance software version (lmsVersion)

Imported Objects

From HCNUM-TC

CounterBasedGauge64

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32
enterprises

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using feTotalEmailCount OID:

Select a FireEye network security/threat-detection appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type feTotalEmailCount into the Find box to locate it in the OID tree, then select it and click OK. This is a count of all the emails coming into postfix and also includes emails which do not contain any URL or attachment (email on fast path). On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
fireeye	1.3.6.1.4.1.25597
variables	1.3.6.1.4.1.25597.1
lms	1.3.6.1.4.1.25597.1.1
OCT lmsVersion	1.3.6.1.4.1.25597.1.1.1	OCTET STRING	accessible-for-notify	System software version string
eventTable	1.3.6.1.4.1.25597.1.1.2		not-accessible	List of events
eventEntry	1.3.6.1.4.1.25597.1.1.2.1		not-accessible	Entry for one event
U32 eventIndex	1.3.6.1.4.1.25597.1.1.2.1.1	Unsigned32	accessible-for-notify	Synthetic numeric unique ID of event
U32 eventId	1.3.6.1.4.1.25597.1.1.2.1.2	Unsigned32	accessible-for-notify	Id of event
OCT eventType	1.3.6.1.4.1.25597.1.1.2.1.3	OCTET STRING	accessible-for-notify	Type of event
OCT eventDate	1.3.6.1.4.1.25597.1.1.2.1.4	OCTET STRING	accessible-for-notify	Date of event
OCT eventTime	1.3.6.1.4.1.25597.1.1.2.1.5	OCTET STRING	accessible-for-notify	Time of event
C64 eventTraceId	1.3.6.1.4.1.25597.1.1.2.1.6	Counter64	accessible-for-notify	Trace ID of event
IP eventSrcIp	1.3.6.1.4.1.25597.1.1.2.1.7	IpAddress	accessible-for-notify	Source IP address of event
IP eventDstIp	1.3.6.1.4.1.25597.1.1.2.1.8	IpAddress	accessible-for-notify	Destination IP address of event
OCT eventSrcMac	1.3.6.1.4.1.25597.1.1.2.1.9	OCTET STRING	accessible-for-notify	Source MAC address of event
OCT eventDstMac	1.3.6.1.4.1.25597.1.1.2.1.10	OCTET STRING	accessible-for-notify	Destination MAC address of event
I32 eventDstPort	1.3.6.1.4.1.25597.1.1.2.1.11	Integer32	accessible-for-notify	Attacked port of event
I32 eventVlan	1.3.6.1.4.1.25597.1.1.2.1.12	Integer32	accessible-for-notify	VLAN of event
OCT eventProtocol	1.3.6.1.4.1.25597.1.1.2.1.13	OCTET STRING	accessible-for-notify	IP protocol of event
U32 eventProfileId	1.3.6.1.4.1.25597.1.1.2.1.14	Unsigned32	accessible-for-notify	Profile ID of event
OCT eventOsInfo	1.3.6.1.4.1.25597.1.1.2.1.15	OCTET STRING	accessible-for-notify	OS info of event
OCT eventService	1.3.6.1.4.1.25597.1.1.2.1.16	OCTET STRING	accessible-for-notify	Attacked service of event
OCT eventAttackType	1.3.6.1.4.1.25597.1.1.2.1.17	OCTET STRING	accessible-for-notify	Attack type of event
OCT eventSignatureName	1.3.6.1.4.1.25597.1.1.2.1.18	OCTET STRING	accessible-for-notify	Signature name of event
OCT eventSignatureType	1.3.6.1.4.1.25597.1.1.2.1.19	OCTET STRING	accessible-for-notify	Signature type of event
OCT eventSrcHost	1.3.6.1.4.1.25597.1.1.2.1.20	OCTET STRING	accessible-for-notify	Host name of event
U32 eventCncNo	1.3.6.1.4.1.25597.1.1.2.1.21	Unsigned32	accessible-for-notify	Cncno of event
U32 alertSignatureId	1.3.6.1.4.1.25597.1.1.2.1.22	Unsigned32	accessible-for-notify	Malware Identification
OCT alertCncHost	1.3.6.1.4.1.25597.1.1.2.1.23	OCTET STRING	accessible-for-notify	Alert CNC host name
I32 alertCncPort	1.3.6.1.4.1.25597.1.1.2.1.24	Integer32	accessible-for-notify	Alert CNC Port
OCT alertChecksum	1.3.6.1.4.1.25597.1.1.2.1.25	OCTET STRING	accessible-for-notify	Alert Malware Checksum
OCT alertAnalysisType	1.3.6.1.4.1.25597.1.1.2.1.26	OCTET STRING	accessible-for-notify	Alert analysis type
OCT alertProfile	1.3.6.1.4.1.25597.1.1.2.1.27	OCTET STRING	accessible-for-notify	Alert analysis profile
OCT alertAction	1.3.6.1.4.1.25597.1.1.2.1.28	OCTET STRING	accessible-for-notify	Alert action taken
OCT alertInterface	1.3.6.1.4.1.25597.1.1.2.1.29	OCTET STRING	accessible-for-notify	Appliance interface
IP alertSensorIp	1.3.6.1.4.1.25597.1.1.2.1.30	IpAddress	accessible-for-notify	Appliance IP address
OCT alertSensorHost	1.3.6.1.4.1.25597.1.1.2.1.31	OCTET STRING	accessible-for-notify	Appliance host name
OCT alertSensorProduct	1.3.6.1.4.1.25597.1.1.2.1.32	OCTET STRING	accessible-for-notify	Product Name
OCT alertSensorRelease	1.3.6.1.4.1.25597.1.1.2.1.33	OCTET STRING	accessible-for-notify	Alert URL
OCT alertUrl	1.3.6.1.4.1.25597.1.1.2.1.34	OCTET STRING	accessible-for-notify	Alert URL
IPt eventSrcAddrType	1.3.6.1.4.1.25597.1.1.2.1.35	InetAddressType	accessible-for-notify	Source IP address type
IP eventSrcAddr	1.3.6.1.4.1.25597.1.1.2.1.36	InetAddress	accessible-for-notify	Source IP address
IPt eventDstAddrType	1.3.6.1.4.1.25597.1.1.2.1.37	InetAddressType	accessible-for-notify	Destination IP address type
IP eventDstAddr	1.3.6.1.4.1.25597.1.1.2.1.38	InetAddress	accessible-for-notify	Destination IP address
IPt eventSensorAddrType	1.3.6.1.4.1.25597.1.1.2.1.39	InetAddressType	accessible-for-notify	Sensor IP address type
IP eventSensorAddr	1.3.6.1.4.1.25597.1.1.2.1.40	InetAddress	accessible-for-notify	Sensor IP address
I32 eventSrcPort	1.3.6.1.4.1.25597.1.1.2.1.41	Integer32	accessible-for-notify	Source port
OCT eventDateTime	1.3.6.1.4.1.25597.1.1.2.1.42	OCTET STRING	accessible-for-notify	Date and time of the event
U32 ipsSignatureId	1.3.6.1.4.1.25597.1.1.2.1.43	Unsigned32	accessible-for-notify	IPS signature id
U32 ipsSignatureRevision	1.3.6.1.4.1.25597.1.1.2.1.44	Unsigned32	accessible-for-notify	IPS signature revision
G32 ipsMatchCount	1.3.6.1.4.1.25597.1.1.2.1.45	Gauge32	accessible-for-notify	Attack count
OCT ipsSeverity	1.3.6.1.4.1.25597.1.1.2.1.46	OCTET STRING	accessible-for-notify	Severity
OCT ipsSignatureName	1.3.6.1.4.1.25597.1.1.2.1.47	OCTET STRING	accessible-for-notify	Name of the signature
OCT ipsReferenceId	1.3.6.1.4.1.25597.1.1.2.1.48	OCTET STRING	accessible-for-notify	Reference ID
OCT ipsBlockMode	1.3.6.1.4.1.25597.1.1.2.1.49	OCTET STRING	accessible-for-notify	isBlocked
OCT ipsAttackTarget	1.3.6.1.4.1.25597.1.1.2.1.50	OCTET STRING	accessible-for-notify	Attack target
U32 eventCount	1.3.6.1.4.1.25597.1.1.3	Unsigned32	accessible-for-notify	Number of events
notifications	1.3.6.1.4.1.25597.3
notificationPrefix	1.3.6.1.4.1.25597.3.0
NTF fireeyeAlert	1.3.6.1.4.1.25597.3.0.1			Execution anomaly detected
NTF executionAnomaly	1.3.6.1.4.1.25597.3.0.2			Execution anomaly detected
NTF networkAnomaly	1.3.6.1.4.1.25597.3.0.3			Network anomaly detected
NTF signatureMatch	1.3.6.1.4.1.25597.3.0.4			Signature match detected
NTF ccConnect	1.3.6.1.4.1.25597.3.0.9			CC connect detected
NTF ccSigmatch	1.3.6.1.4.1.25597.3.0.10			CC sigmatch detected
NTF osChange	1.3.6.1.4.1.25597.3.0.11			OS change anomaly detected
NTF ipsAlert	1.3.6.1.4.1.25597.3.0.12			IPS anomaly detected.
feCommon	1.3.6.1.4.1.25597.11
feSystem	1.3.6.1.4.1.25597.11.1
feSystemTraps	1.3.6.1.4.1.25597.11.1.0
NTF feExcessiveTemperature	1.3.6.1.4.1.25597.11.1.0.1			Excessive temperature has reached.
NTF feNormalTemperature	1.3.6.1.4.1.25597.11.1.0.2			Temperature is normal.
NTF feIfLinkChange	1.3.6.1.4.1.25597.11.1.0.3			The speed of an interface has changed.
feSystemInfo	1.3.6.1.4.1.25597.11.1.1
OCT feSystemStatus	1.3.6.1.4.1.25597.11.1.1.1	OCTET STRING	read-only	Overall system status
OCT feHardwareModel	1.3.6.1.4.1.25597.11.1.1.2	OCTET STRING	read-only	Hardware model
OCT feSerialNumber	1.3.6.1.4.1.25597.11.1.1.3	OCTET STRING	read-only	Serial number
I32 feTemperatureValue	1.3.6.1.4.1.25597.11.1.1.4	Integer32	read-only	System temperature in Celsius
OCT feTemperatureStatus	1.3.6.1.4.1.25597.11.1.1.5	OCTET STRING	read-only	System temperature status
T/F feTemperatureIsHealthy	1.3.6.1.4.1.25597.11.1.1.6	TruthValue	read-only	Whether or not the temperature is normal.
OCT feIfLinkChangeIfname	1.3.6.1.4.1.25597.11.1.1.7	OCTET STRING	accessible-for-notify	The name of the interface that has changed its speed.
T/F feIfLinkChangeOldAdminUp	1.3.6.1.4.1.25597.11.1.1.8	TruthValue	accessible-for-notify	The old admin up state of the interface.
T/F feIfLinkChangeNewAdminUp	1.3.6.1.4.1.25597.11.1.1.9	TruthValue	accessible-for-notify	The new admin up state of the interface.
T/F feIfLinkChangeOldLinkUp	1.3.6.1.4.1.25597.11.1.1.10	TruthValue	accessible-for-notify	The old link up state of the interface.
T/F feIfLinkChangeNewLinkUp	1.3.6.1.4.1.25597.11.1.1.11	TruthValue	accessible-for-notify	The new link up state of the interface.
I32 feIfLinkChangeOldSpeed	1.3.6.1.4.1.25597.11.1.1.12	Integer32	accessible-for-notify	The old speed of the interface.
I32 feIfLinkChangeNewSpeed	1.3.6.1.4.1.25597.11.1.1.13	Integer32	accessible-for-notify	The new speed of the interface.
I32 feIfLinkChangeOldDuplex	1.3.6.1.4.1.25597.11.1.1.14	Integer32	accessible-for-notify	The old duplex of the interface.
I32 feIfLinkChangeNewDuplex	1.3.6.1.4.1.25597.11.1.1.15	Integer32	accessible-for-notify	The new duplex of the interface.
T/F feIfLinkChangeOldAutoNeg	1.3.6.1.4.1.25597.11.1.1.16	TruthValue	accessible-for-notify	The old auto negotiation of the interface.
T/F feIfLinkChangeNewAutoNeg	1.3.6.1.4.1.25597.11.1.1.17	TruthValue	accessible-for-notify	The new auto negotiation of the interface.
feStorage	1.3.6.1.4.1.25597.11.2
feStorageTraps	1.3.6.1.4.1.25597.11.2.0
NTF feRaidFailure	1.3.6.1.4.1.25597.11.2.0.1			A RAID error has occurred.
NTF feRaidRecover	1.3.6.1.4.1.25597.11.2.0.2			RAID has recovered.
NTF fePhysicalDiskFailure	1.3.6.1.4.1.25597.11.2.0.3			A physical disk has failed.
NTF fePhysicalDiskRecover	1.3.6.1.4.1.25597.11.2.0.4			A physical disk has recovered.
feStorageInfo	1.3.6.1.4.1.25597.11.2.1
OCT feRaidStatus	1.3.6.1.4.1.25597.11.2.1.1	OCTET STRING	read-only	RAID status
T/F feRaidIsHealthy	1.3.6.1.4.1.25597.11.2.1.2	TruthValue	read-only	Whether or not RAID is healthy overall.
fePhysicalDiskTable	1.3.6.1.4.1.25597.11.2.1.3		not-accessible	The physical disk table
fePhysicalDiskEntry	1.3.6.1.4.1.25597.11.2.1.3.1		not-accessible	An entry for one physical disk
U32 fePhysicalDiskIndex	1.3.6.1.4.1.25597.11.2.1.3.1.1	Unsigned32	read-only	A unique value for each disk
OCT fePhysicalDiskName	1.3.6.1.4.1.25597.11.2.1.3.1.2	OCTET STRING	read-only	Physical disk name
OCT fePhysicalDiskStatus	1.3.6.1.4.1.25597.11.2.1.3.1.3	OCTET STRING	read-only	Physical disk status
T/F fePhysicalDiskIsHealthy	1.3.6.1.4.1.25597.11.2.1.3.1.4	TruthValue	read-only	Whether a physical disk is healthy.
OCT fePhysicalDiskDeviceSupport	1.3.6.1.4.1.25597.11.2.1.3.1.5	OCTET STRING	read-only	Physical disk configuration, e.g. RAID
OCT fePhysicalDiskSelfAssess	1.3.6.1.4.1.25597.11.2.1.3.1.6	OCTET STRING	read-only	Self assess of a physical disk
OCT fePhysicalDiskTotalBytes	1.3.6.1.4.1.25597.11.2.1.3.1.7	OCTET STRING	read-only	The capacity of a physical disk.
fePowerSupply	1.3.6.1.4.1.25597.11.3
fePowerSupplyTraps	1.3.6.1.4.1.25597.11.3.0
NTF fePowerSupplyFailure	1.3.6.1.4.1.25597.11.3.0.1			A power supply has failed.
NTF fePowerSupplyRecover	1.3.6.1.4.1.25597.11.3.0.2			A power supply has recovered.
fePowerSupplyInfo	1.3.6.1.4.1.25597.11.3.1
OCT fePowerSupplyOverallStatus	1.3.6.1.4.1.25597.11.3.1.1	OCTET STRING	read-only	Overall power supply status
T/F fePowerSupplyOverallIsHealthy	1.3.6.1.4.1.25597.11.3.1.2	TruthValue	read-only	Whether or not power supply is healthy overall.
fePowerSupplyTable	1.3.6.1.4.1.25597.11.3.1.3		not-accessible	The power supply table
fePowerSupplyEntry	1.3.6.1.4.1.25597.11.3.1.3.1		not-accessible	An entry for one physical disk
U32 fePowerSupplyIndex	1.3.6.1.4.1.25597.11.3.1.3.1.1	Unsigned32	read-only	A unique value for each power supply
OCT fePowerSupplyStatus	1.3.6.1.4.1.25597.11.3.1.3.1.2	OCTET STRING	read-only	Power supply status
T/F fePowerSupplyIsHealthy	1.3.6.1.4.1.25597.11.3.1.3.1.3	TruthValue	read-only	Whether a power supply is healthy.
feFanHealth	1.3.6.1.4.1.25597.11.4
feFanHealthTraps	1.3.6.1.4.1.25597.11.4.0
NTF feFanFailure	1.3.6.1.4.1.25597.11.4.0.1			A fan has failed.
NTF feFanRecover	1.3.6.1.4.1.25597.11.4.0.2			A fan has recovered.
feFanHealthInfo	1.3.6.1.4.1.25597.11.4.1
OCT feFanOverallStatus	1.3.6.1.4.1.25597.11.4.1.1	OCTET STRING	read-only	Overall fan status
T/F feFanOverallIsHealthy	1.3.6.1.4.1.25597.11.4.1.2	TruthValue	read-only	Whether or not fan is healthy overall.
feFanStatusTable	1.3.6.1.4.1.25597.11.4.1.3		not-accessible	The Fan Status table
feFanStatusEntry	1.3.6.1.4.1.25597.11.4.1.3.1		not-accessible	An entry for one fan
U32 feFanIndex	1.3.6.1.4.1.25597.11.4.1.3.1.1	Unsigned32	read-only	A unique value for each fan status table entry
OCT feFanStatus	1.3.6.1.4.1.25597.11.4.1.3.1.2	OCTET STRING	read-only	Fan status
T/F feFanIsHealthy	1.3.6.1.4.1.25597.11.4.1.3.1.3	TruthValue	read-only	Whether a fan is healthy.
U32 feFanSpeed	1.3.6.1.4.1.25597.11.4.1.3.1.4	Unsigned32	read-only	Fan speed in rpm
feApplication	1.3.6.1.4.1.25597.11.5
feApplicationTraps	1.3.6.1.4.1.25597.11.5.0
NTF feLicenseStateChanged	1.3.6.1.4.1.25597.11.5.0.1			A license state has changed.
NTF feSecurityUpdateFailed	1.3.6.1.4.1.25597.11.5.0.2			Security update has failed.
feApplicationInfo	1.3.6.1.4.1.25597.11.5.1
OCT feInstalledSystemImage	1.3.6.1.4.1.25597.11.5.1.1	OCTET STRING	read-only	Current installed system image
OCT feSystemImageVersionCurrent	1.3.6.1.4.1.25597.11.5.1.2	OCTET STRING	read-only	Current system image version
OCT feSystemImageVersionLatest	1.3.6.1.4.1.25597.11.5.1.3	OCTET STRING	read-only	Latest system image version
T/F feIsSystemImageLatest	1.3.6.1.4.1.25597.11.5.1.4	TruthValue	read-only	Whether or not the current system image is the latest.
OCT feSecurityContentVersion	1.3.6.1.4.1.25597.11.5.1.5	OCTET STRING	read-only	Security content version
T/F feLastContentUpdatePassed	1.3.6.1.4.1.25597.11.5.1.6	TruthValue	read-only	Whether the last security content updated has passed.
OCT feLastContentUpdateTime	1.3.6.1.4.1.25597.11.5.1.7	OCTET STRING	read-only	The last update time for security contents
feGIVersionTable	1.3.6.1.4.1.25597.11.5.1.8		not-accessible	The guest image version table
feGIVersionEntry	1.3.6.1.4.1.25597.11.5.1.8.1		not-accessible	An entry for one guest image
U32 feGIIndex	1.3.6.1.4.1.25597.11.5.1.8.1.1	Unsigned32	read-only	A unique value for each guest image
OCT feGIName	1.3.6.1.4.1.25597.11.5.1.8.1.2	OCTET STRING	read-only	Guest image name
OCT feGIVersion	1.3.6.1.4.1.25597.11.5.1.8.1.3	OCTET STRING	read-only	Guest image version
T/F feGIEnabled	1.3.6.1.4.1.25597.11.5.1.8.1.4	TruthValue	read-only	Whether guest image is enabled.
OCT feGIInstallDateTime	1.3.6.1.4.1.25597.11.5.1.8.1.5	OCTET STRING	read-only	Guest image install date and time
U32 feActiveVMs	1.3.6.1.4.1.25597.11.5.1.9	Unsigned32	read-only	Number of active VMs
T/F feProductLicenseActive	1.3.6.1.4.1.25597.11.5.1.10	TruthValue	read-only	Whether the product license is active.
T/F feContentLicenseActive	1.3.6.1.4.1.25597.11.5.1.11	TruthValue	read-only	Whether the content license is active.
T/F feSupportLicenseActive	1.3.6.1.4.1.25597.11.5.1.12	TruthValue	read-only	Whether the support license is active.
OCT feLicenseFeatureName	1.3.6.1.4.1.25597.11.5.1.13	OCTET STRING	accessible-for-notify	License feature name for the feLicenseStateChanged event.
T/F feLicenseNewActiveState	1.3.6.1.4.1.25597.11.5.1.14	TruthValue	accessible-for-notify	The new license active state for the feLicenseStateChanged event.
T/F feLicenseOldActiveState	1.3.6.1.4.1.25597.11.5.1.15	TruthValue	accessible-for-notify	The old license active state for the feLicenseStateChanged event.
feCMS	1.3.6.1.4.1.25597.12
feCMSTraps	1.3.6.1.4.1.25597.12.0
NTF feCMSHAUnexpectedFailover	1.3.6.1.4.1.25597.12.0.1			An unexpected fail-over on CMS-HA has occurred.
NTF feCMSHAManualFailover	1.3.6.1.4.1.25597.12.0.2			A manual fail-over on CMS-HA has occurred.
feCMSInfo	1.3.6.1.4.1.25597.12.1
U32 feTotalAppliancesAttached	1.3.6.1.4.1.25597.12.1.1	Unsigned32	read-only	Total appliances attached
U32 feTotalWMPSAttached	1.3.6.1.4.1.25597.12.1.2	Unsigned32	read-only	Total WMPS attached
U32 feTotalEMPSAttached	1.3.6.1.4.1.25597.12.1.3	Unsigned32	read-only	Total EMPS attached
U32 feTotalFMPSAttached	1.3.6.1.4.1.25597.12.1.4	Unsigned32	read-only	Total FMPS attached
U32 feTotalMASAttached	1.3.6.1.4.1.25597.12.1.5	Unsigned32	read-only	Total MAS attached
feCMSApplianceTable	1.3.6.1.4.1.25597.12.1.6		not-accessible	The CMS managed appliance table
feCMSApplianceEntry	1.3.6.1.4.1.25597.12.1.6.1		not-accessible	An entry for one CMS managed appliance
U32 feCMSApplianceIndex	1.3.6.1.4.1.25597.12.1.6.1.1	Unsigned32	read-only	A unique value for each CMS managed appliance
OCT feCMSApplianceName	1.3.6.1.4.1.25597.12.1.6.1.2	OCTET STRING	read-only	The name of the CMS managed appliance
T/F feCMSApplianceDiskSpacePassed	1.3.6.1.4.1.25597.12.1.6.1.3	TruthValue	read-only	Whether a CMS managed appliance passed disk space check.
T/F feCMSApplianceFanPassed	1.3.6.1.4.1.25597.12.1.6.1.4	TruthValue	read-only	Whether a CMS managed appliance passed fan check.
T/F feCMSAppliancePowerSupplyPassed	1.3.6.1.4.1.25597.12.1.6.1.5	TruthValue	read-only	Whether a CMS managed appliance passed power supply check.
T/F feCMSApplianceRaidPassed	1.3.6.1.4.1.25597.12.1.6.1.6	TruthValue	read-only	Whether a CMS managed appliance passed RAID check.
T/F feCMSApplianceTemperaturePassed	1.3.6.1.4.1.25597.12.1.6.1.7	TruthValue	read-only	Whether a CMS managed appliance passed temperature check.
feEMPS	1.3.6.1.4.1.25597.13
feEMPSTraps	1.3.6.1.4.1.25597.13.0
NTF feDeferredQueueThreshold	1.3.6.1.4.1.25597.13.0.1			Deferred queue email count exceeded a certain threshold.
NTF feBypassCountThreshold	1.3.6.1.4.1.25597.13.0.2			Current bypass count exceeded a certain threshold.
NTF feSmtpInterfaceRefuseConnection	1.3.6.1.4.1.25597.13.0.3			SMTP interface set to refuse connections because of congestion.
NTF feSmtpInterfaceRecover	1.3.6.1.4.1.25597.13.0.4			SMTP interface re-enabled after recover.
NTF feEMPSBypassStateEntered	1.3.6.1.4.1.25597.13.0.5			Email bypass state entered.
NTF feEMPSBypassStateExited	1.3.6.1.4.1.25597.13.0.6			Email bypass state exited.
feEMPSInfo	1.3.6.1.4.1.25597.13.1
C64 feTotalEmailCountEx	1.3.6.1.4.1.25597.13.1.1	Counter64	read-only	This is a count of all the emails coming into postfix and also includes emails which do not contain any URL or attachment (email on fast path). This will be the cumulative value and maintained across appliance reboots.
C32 feTotalEmailCountH	1.3.6.1.4.1.25597.13.1.2	Counter32	read-only	This is a count of all the emails coming into postfix and also includes emails which do not contain any URL or attachment (email on fast path). This will be the cumulative value and maintained across appliance reboots. feTotalEmailCountH is the high order 32bit of the 64bit counter.
C32 feTotalEmailCountL	1.3.6.1.4.1.25597.13.1.3	Counter32	read-only	This is a count of all the emails coming into postfix and also includes emails which do not contain any URL or attachment (email on fast path). This will be the cumulative value and maintained across appliance reboots. feTotalEmailCountL is the low order 32bit of the 64bit counter.
C64 feInfectedEmailCount	1.3.6.1.4.1.25597.13.1.4	Counter64	read-only	This is a count of all the email which are determined to be malicious. This is the same as 'Total Email Received with Malicious Content' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots.
C32 feInfectedEmailCountH	1.3.6.1.4.1.25597.13.1.5	Counter32	read-only	This is a count of all the email which are determined to be malicious. This is the same as 'Total Email Received with Malicious Content' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feInfectedEmailCountH is the high order 32bit of the 64bit counter.
C32 feInfectedEmailCountL	1.3.6.1.4.1.25597.13.1.6	Counter32	read-only	This is a count of all the email which are determined to be malicious. This is the same as 'Total Email Received with Malicious Content' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feInfectedEmailCountL is the low order 32bit of the 64bit counter.
C64 feAnalyzedEmailCount	1.3.6.1.4.1.25597.13.1.7	Counter64	read-only	This is cumulative count of all the email which were analyzed. This is the same as 'Total Emails Received and Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots.
C32 feAnalyzedEmailCountH	1.3.6.1.4.1.25597.13.1.8	Counter32	read-only	This is cumulative count of all the email which were analyzed. This is the same as 'Total Emails Received and Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots. feAnalyzedEmailCountH is the high order 32bit of the 64bit counter.
C32 feAnalyzedEmailCountL	1.3.6.1.4.1.25597.13.1.9	Counter32	read-only	This is cumulative count of all the email which were analyzed. This is the same as 'Total Emails Received and Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots. feAnalyzedEmailCountL is the low order 32bit of the 64bit counter.
C64 feTotalUrlCount	1.3.6.1.4.1.25597.13.1.10	Counter64	read-only	This is a count of all the URLs received whether they are processed or not. This is the same as 'Total URLs Received' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots.
C32 feTotalUrlCountH	1.3.6.1.4.1.25597.13.1.11	Counter32	read-only	This is a count of all the URLs received whether they are processed or not. This is the same as 'Total URLs Received' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feTotalUrlCountH is the high order 32bit of the 64bit counter.
C32 feTotalUrlCountL	1.3.6.1.4.1.25597.13.1.12	Counter32	read-only	This is a count of all the URLs received whether they are processed or not. This is the same as 'Total URLs Received' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feTotalUrlCountL is the low order 32bit of the 64bit counter.
C64 feInfectedUrlCount	1.3.6.1.4.1.25597.13.1.13	Counter64	read-only	This is a count of all the URLs that are determined to be malicious and is the same as 'Total URLs Considered Malicious' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots.
C32 feInfectedUrlCountH	1.3.6.1.4.1.25597.13.1.14	Counter32	read-only	This is a count of all the URLs that are determined to be malicious and is the same as 'Total URLs Considered Malicious' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feInfectedUrlCountH is the high order 32bit of the 64bit counter.
C32 feInfectedUrlCountL	1.3.6.1.4.1.25597.13.1.15	Counter32	read-only	This is a count of all the URLs that are determined to be malicious and is the same as 'Total URLs Considered Malicious' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feInfectedUrlCountH is the low order 32bit of the 64bit counter.
C64 feAnalyzedUrlCount	1.3.6.1.4.1.25597.13.1.16	Counter64	read-only	This is the cumulative count of all the URLs that were analyzed and is the same as 'Total URLs Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots.
C32 feAnalyzedUrlCountH	1.3.6.1.4.1.25597.13.1.17	Counter32	read-only	This is the cumulative count of all the URLs that were analyzed and is the same as 'Total URLs Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots. feAnalyzedUrlCountH is the high order 32bit of the 64bit counter.
C32 feAnalyzedUrlCountL	1.3.6.1.4.1.25597.13.1.18	Counter32	read-only	This is the cumulative count of all the URLs that were analyzed and is the same as 'Total URLs Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots. feAnalyzedUrlCountL is the low order 32bit of the 64bit counter.
C64 feTotalAttachmentCount	1.3.6.1.4.1.25597.13.1.19	Counter64	read-only	This is a count of all the attachment received whether they are processed or not. This is the same as 'Total Attachments Received' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots.
C32 feTotalAttachmentCountH	1.3.6.1.4.1.25597.13.1.20	Counter32	read-only	This is a count of all the attachment received whether they are processed or not. This is the same as 'Total Attachments Received' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feTotalAttachmentCountH is the high order 32bit of the 64bit counter.
C32 feTotalAttachmentCountL	1.3.6.1.4.1.25597.13.1.21	Counter32	read-only	This is a count of all the attachment received whether they are processed or not. This is the same as 'Total Attachments Received' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feTotalAttachmentCountL is the low order 32bit of the 64bit counter.
C64 feInfectedAttachmentCount	1.3.6.1.4.1.25597.13.1.22	Counter64	read-only	This is a count of all the attachment that are determined to be malicious and is the same as 'Total Attachments Considered Malicious' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots.
C32 feInfectedAttachmentCountH	1.3.6.1.4.1.25597.13.1.23	Counter32	read-only	This is a count of all the attachment that are determined to be malicious and is the same as 'Total Attachments Considered Malicious' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feInfectedAttachmentCountH is the high order 32bit of the 64bit counter.
C32 feInfectedAttachmentCountL	1.3.6.1.4.1.25597.13.1.24	Counter32	read-only	This is a count of all the attachment that are determined to be malicious and is the same as 'Total Attachments Considered Malicious' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feInfectedAttachmentCountL is the low order 32bit of the 64bit counter.
C64 feAnalyzedAttachmentCount	1.3.6.1.4.1.25597.13.1.25	Counter64	read-only	This is the cumulative count of all the attachment that we analyzed for maliciousness. This is the same as 'Total Attachments Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots.
C32 feAnalyzedAttachmentCountH	1.3.6.1.4.1.25597.13.1.26	Counter32	read-only	This is the cumulative count of all the attachment that we analyzed for maliciousness. This is the same as 'Total Attachments Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots. feAnalyzedAttachmentCountH is the high order 32bit of the 64bit counter.
C32 feAnalyzedAttachmentCountL	1.3.6.1.4.1.25597.13.1.27	Counter32	read-only	This is the cumulative count of all the attachment that we analyzed for maliciousness. This is the same as 'Total Attachments Analyzed' that we currently show in the output to CLI command 'show email-analysis statistics'. This counter will maintain its value across reboots. feAnalyzedAttachmentCountL is the low order 32bit of the 64bit counter.
C64 feTotalEmailHasAttachment	1.3.6.1.4.1.25597.13.1.28	Counter64	read-only	This is a count of all the emails containing at least one attachment. This value will be the cumulative and preserved across appliance reboots.
C32 feTotalEmailHasAttachmentH	1.3.6.1.4.1.25597.13.1.29	Counter32	read-only	This is a count of all the emails containing at least one attachment. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasAttachmentH is the high order 32bit of the 64bit counter.
C32 feTotalEmailHasAttachmentL	1.3.6.1.4.1.25597.13.1.30	Counter32	read-only	This is a count of all the emails containing at least one attachment. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasAttachmentL is the low order 32bit of the 64bit counter.
C64 feTotalEmailHasUrl	1.3.6.1.4.1.25597.13.1.31	Counter64	read-only	This is a count of all the emails containing at least one URL. This value will be the cumulative and preserved across appliance reboots.
C32 feTotalEmailHasUrlH	1.3.6.1.4.1.25597.13.1.32	Counter32	read-only	This is a count of all the emails containing at least one URL. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasUrlH is the high order 32bit of the 64bit counter.
C32 feTotalEmailHasUrlL	1.3.6.1.4.1.25597.13.1.33	Counter32	read-only	This is a count of all the emails containing at least one URL. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasUrlL is the low order 32bit of the 64bit counter.
C64 feTotalEmailHasBadAttachment	1.3.6.1.4.1.25597.13.1.34	Counter64	read-only	This is a count of all the emails containing at least one attachment determined to be malicious. This value will be the cumulative and preserved across appliance reboots.
C32 feTotalEmailHasBadAttachmentH	1.3.6.1.4.1.25597.13.1.35	Counter32	read-only	This is a count of all the emails containing at least one attachment determined to be malicious. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasBadAttachmentH is the high order 32bit of the 64bit counter.
C32 feTotalEmailHasBadAttachmentL	1.3.6.1.4.1.25597.13.1.36	Counter32	read-only	This is a count of all the emails containing at least one attachment determined to be malicious. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasBadAttachmentL is the low order 32bit of the 64bit counter.
C64 feTotalEmailHasBadUrl	1.3.6.1.4.1.25597.13.1.37	Counter64	read-only	This is a count of all the emails containing at least one URL determined to be malicious. This value will be the cumulative and preserved across appliance reboots.
C32 feTotalEmailHasBadUrlH	1.3.6.1.4.1.25597.13.1.38	Counter32	read-only	This is a count of all the emails containing at least one URL determined to be malicious. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasBadUrlH is the high order 32bit of the 64bit counter.
C32 feTotalEmailHasBadUrlL	1.3.6.1.4.1.25597.13.1.39	Counter32	read-only	This is a count of all the emails containing at least one URL determined to be malicious. This value will be the cumulative and preserved across appliance reboots. feTotalEmailHasBadUrlL is the low order 32bit of the 64bit counter.
U32 feeQuarantineUsage	1.3.6.1.4.1.25597.13.1.40	Unsigned32	read-only	This is consumed capacity in term of percentage of max capacity. This is a snapshot value and represents current consumption value.
C64 feBypassEmailCount	1.3.6.1.4.1.25597.13.1.41	Counter64	read-only	This is a count of Bypassed Emails and is the same as 'Total Emails Bypassed' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots.
C32 feBypassEmailCountH	1.3.6.1.4.1.25597.13.1.42	Counter32	read-only	This is a count of Bypassed Emails and is the same as 'Total Emails Bypassed' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feBypassEmailCountH is the high order 32bit of the 64bit counter.
C32 feBypassEmailCountL	1.3.6.1.4.1.25597.13.1.43	Counter32	read-only	This is a count of Bypassed Emails and is the same as 'Total Emails Bypassed' that we currently show in the output to CLI command 'show email-analysis statistics'. This will be the cumulative value and is maintained across appliance reboots. feBypassEmailCountL is the low order 32bit of the 64bit counter.
U32 feDeferredEmailCount	1.3.6.1.4.1.25597.13.1.44	Unsigned32	read-only	This is a count of deferred emails and will represent snapshot current value.
U32 feHoldQueueEmailCount	1.3.6.1.4.1.25597.13.1.45	Unsigned32	read-only	This is a count of emails in the hold queue and will represent current snapshot value.
U32 feOpenSmtpConnections	1.3.6.1.4.1.25597.13.1.46	Unsigned32	read-only	This is a snapshot value of currently open SMTP connections.
feWMPS	1.3.6.1.4.1.25597.14
feWMPSTraps	1.3.6.1.4.1.25597.14.0
NTF feHttpThroughputNotIncrease	1.3.6.1.4.1.25597.14.0.1			HTTP throughput has not increased for a specified time.
NTF feHardwareBypassEntered	1.3.6.1.4.1.25597.14.0.2			Permanent hardware bypass mode entered.
feWMPSInfo	1.3.6.1.4.1.25597.14.1
feMAS	1.3.6.1.4.1.25597.15
feMASTraps	1.3.6.1.4.1.25597.15.0
NTF feMaliciousMaid	1.3.6.1.4.1.25597.15.0.1			A malicious URL or file detected.
feMASInfo	1.3.6.1.4.1.25597.15.1
C64 feTotalObjectAnalyzedCount	1.3.6.1.4.1.25597.15.1.1	Counter64	read-only	This is a count of all the object analyzed, including all children of any samples, including URL.
C32 feTotalObjectAnalyzedCountH	1.3.6.1.4.1.25597.15.1.2	Counter32	read-only	This is a count of all the object analyzed, including all children of any samples, including URL. feTotalObjectAnalyzedCountH is the high order 32bit of the 64bit counter.
C32 feTotalObjectAnalyzedCountL	1.3.6.1.4.1.25597.15.1.3	Counter32	read-only	This is a count of all the object analyzed, including all children of any samples, including URL. feTotalObjectAnalyzedCountL is the low order 32bit of the 64bit counter.
C64 feTotalMaliciousObjectCount	1.3.6.1.4.1.25597.15.1.4	Counter64	read-only	This is a count of all malicious samples detected.
C32 feTotalMaliciousObjectCountH	1.3.6.1.4.1.25597.15.1.5	Counter32	read-only	This is a count of all malicious samples detected. feTotalMaliciousObjectCountH is the high order 32bit of the 64bit counter.
C32 feTotalMaliciousObjectCountL	1.3.6.1.4.1.25597.15.1.6	Counter32	read-only	This is a count of all malicious samples detected. feTotalMaliciousObjectCountL is the low order 32bit of the 64bit counter.
C64 feTotalUrlAnalyzedCount	1.3.6.1.4.1.25597.15.1.7	Counter64	read-only	This is a count of all samples that has file type: url.
C32 feTotalUrlAnalyzedCountH	1.3.6.1.4.1.25597.15.1.8	Counter32	read-only	This is a count of all samples that has file type: url. feTotalUrlAnalyzedCountH is the high order 32bit of the 64bit counter.
C32 feTotalUrlAnalyzedCountL	1.3.6.1.4.1.25597.15.1.9	Counter32	read-only	This is a count of all samples that has file type: url. feTotalUrlAnalyzedCountL is the low order 32bit of the 64bit counter.
C64 feTotalMaliciousUrlCount	1.3.6.1.4.1.25597.15.1.10	Counter64	read-only	This is a count of all samples that has file type 'url' and also are malicious.
C32 feTotalMaliciousUrlCountH	1.3.6.1.4.1.25597.15.1.11	Counter32	read-only	This is a count of all samples that has file type 'url' and also are malicious. feTotalMaliciousUrlCountH is the high order 32bit of the 64bit counter.
C32 feTotalMaliciousUrlCountL	1.3.6.1.4.1.25597.15.1.12	Counter32	read-only	This is a count of all samples that has file type 'url' and also are malicious. feTotalMaliciousUrlCountL is the low order 32bit of the 64bit counter.
C64 feTotalFileUploadedCount	1.3.6.1.4.1.25597.15.1.13	Counter64	read-only	This is a count of all object that has no parent (basically, children will not be counted).
C32 feTotalFileUploadedCountH	1.3.6.1.4.1.25597.15.1.14	Counter32	read-only	This is a count of all object that has no parent (basically, children will not be counted). feTotalFileUploadedCountH is the high order 32bit of the 64bit counter.
C32 feTotalFileUploadedCountL	1.3.6.1.4.1.25597.15.1.15	Counter32	read-only	This is a count of all object that has no parent (basically, children will not be counted). feTotalFileUploadedCountL is the low order 32bit of the 64bit counter.
C64 feTotalMaliciousFileCount	1.3.6.1.4.1.25597.15.1.16	Counter64	read-only	This is a count of all object that has no parent (basically children will not be counted), and are not URL.
C32 feTotalMaliciousFileCountH	1.3.6.1.4.1.25597.15.1.17	Counter32	read-only	This is a count of all object that has no parent (basically children will not be counted), and are not URL. feTotalMaliciousFileCountH is the high order 32bit of the 64bit counter.
C32 feTotalMaliciousFileCountL	1.3.6.1.4.1.25597.15.1.18	Counter32	read-only	This is a count of all object that has no parent (basically children will not be counted), and are not URL. feTotalMaliciousFileCountL is the low order 32bit of the 64bit counter.
C64 feTotalLiveModeCount	1.3.6.1.4.1.25597.15.1.19	Counter64	read-only	This is a count of all object that are submitted for live mode.
C32 feTotalLiveModeCountH	1.3.6.1.4.1.25597.15.1.20	Counter32	read-only	This is a count of all object that are submitted for live mode. feTotalLiveModeCountH is the high order 32bit of the 64bit counter.
C32 feTotalLiveModeCountL	1.3.6.1.4.1.25597.15.1.21	Counter32	read-only	This is a count of all object that are submitted for live mode. feTotalLiveModeCountL is the low order 32bit of the 64bit counter.
C64 feTotalMaliciousLiveModeCount	1.3.6.1.4.1.25597.15.1.22	Counter64	read-only	This is a count of all object that are submitted for live mode and are malicious. Live mode object has no children.
C32 feTotalMaliciousLiveModeCountH	1.3.6.1.4.1.25597.15.1.23	Counter32	read-only	This is a count of all object that are submitted for live mode and are malicious. Live mode object has no children. feTotalMaliciousLiveModeCountH is the high order 32bit of the 64bit counter.
C32 feTotalMaliciousLiveModeCountL	1.3.6.1.4.1.25597.15.1.24	Counter32	read-only	This is a count of all object that are submitted for live mode and are malicious. Live mode object has no children. feTotalMaliciousLiveModeCountL is the low order 32bit of the 64bit counter.
NUM feMaid	1.3.6.1.4.1.25597.15.1.25	CounterBasedGauge64	accessible-for-notify	ID of the malicious sample/url.
feMibAdminInfo	1.3.6.1.4.1.25597.20
fireeyeMibModule	1.3.6.1.4.1.25597.20.1			FireEye Inc Vendor MIB
feMibCompliances	1.3.6.1.4.1.25597.20.2
feMibCompliance	1.3.6.1.4.1.25597.20.2.1			The requirements for conformance to the FireEye MIB.
feMibGroups	1.3.6.1.4.1.25597.20.3
feVariablesGroup	1.3.6.1.4.1.25597.20.3.1			This groups contains objects for malware alerts.
feNotificationsGroup	1.3.6.1.4.1.25597.20.3.2			This groups contains notifications for malware alerts.
feSystemInfoGroup	1.3.6.1.4.1.25597.20.3.11			FireEye System Info Group.
feSystemTrapGroup	1.3.6.1.4.1.25597.20.3.12			FireEye System Trap Group.
feStorageInfoGroup	1.3.6.1.4.1.25597.20.3.13			FireEye Storage Info Group.
feStorageTrapGroup	1.3.6.1.4.1.25597.20.3.14			FireEye Storage Trap Group.
fePowerSupplyInfoGroup	1.3.6.1.4.1.25597.20.3.15			FireEye Power Supply Info Group.
fePowerSupplyTrapGroup	1.3.6.1.4.1.25597.20.3.16			FireEye Power Supply Trap Group.
feFanHealthInfoGroup	1.3.6.1.4.1.25597.20.3.17			FireEye Fan Health Info Group.
feFanHealthTrapGroup	1.3.6.1.4.1.25597.20.3.18			FireEye Fan Health Trap Group.
feApplicationInfoGroup	1.3.6.1.4.1.25597.20.3.19			FireEye Application Info Group.
feApplicationTrapGroup	1.3.6.1.4.1.25597.20.3.20			FireEye Application Trap Group.
feCMSInfoGroup	1.3.6.1.4.1.25597.20.3.21			FireEye CMPS Info Group.
feCMSTrapGroup	1.3.6.1.4.1.25597.20.3.22			FireEye CMS Trap Group.
feEMPSInfoGroup	1.3.6.1.4.1.25597.20.3.23			FireEye Email MPS Group.
feEMPSTrapGroup	1.3.6.1.4.1.25597.20.3.24			FireEye Email MPS Trap Group.
feWMPSTrapGroup	1.3.6.1.4.1.25597.20.3.26			FireEye Web MPS Trap Group.
feMASInfoGroup	1.3.6.1.4.1.25597.20.3.27			FireEye MAS Group.
feMASTrapGroup	1.3.6.1.4.1.25597.20.3.28			FireEye MAS Trap Group.

RFC description

FireEye security appliance MIB providing intrusion prevention, malware detection, and threat management monitoring.

Start monitoring FireEye network security/threat-detection appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FE-FIREEYE-MIB