FORTINET-FORTISANDBOX-MIB

All MIBs › FORTINET-FORTISANDBOX-MIB

Organization: Fortinet Technologies, Inc.

Last Updated: 2014-02-24

Category: Domain: Security, Vendor: Fortinet

Description: Fortinet FortiSandbox MIB providing SNMP management objects for advanced threat detection sandbox appliance status and file analysis statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FORTINET-FORTISANDBOX-MIB?

FORTINET-FORTISANDBOX-MIB is Fortinet's vendor-specific SNMP module for FortiSandbox, an advanced threat-detection appliance that detonates suspicious files in isolated virtual environments to identify malware. It exposes system resource objects, hardware health traps, per-job analysis status, and model/version identification for the appliance. It is strongly oriented toward monitoring hardware and software status, including fsaSysCpuUsage, fsaSysMemUsage/fsaSysMemCapacity, and fsaSysDiskUsage for resource load, fsaTrapPSUFailure for power supply failure, fsaTrapHCHealth/fsaTrapHCTopology for high-availability cluster health, and fsaSysVersion/fsaModel for software and hardware model identification. It relies on standard SNMP trap conventions and the Fortinet enterprise OID tree shared with other Forti-product MIBs. It is deployed in security operations environments where FortiSandbox appliances process a high volume of file-analysis jobs and administrators need to watch for resource exhaustion or hardware faults that could stall the analysis queue. Engineers can download the FORTINET-FORTISANDBOX-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FORTINET-FORTISANDBOX-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Fortinet FortiSandbox threat-detection appliance

Monitoring Examples

An administrator would poll fsaSysCpuUsage, fsaSysMemUsage, and fsaSysDiskUsage to see if the sandbox is resource-constrained, which would manifest as growing per-job backlogs identified via fsaTrapJobId in trap notifications. A fsaTrapPSUFailure trap indicates a failed power supply on models such as fsa1000D or fsa3000D, requiring urgent hardware attention, while fsaTrapHCHealth reveals whether a clustered high-availability pair has degraded. fsaSysVersion is useful to confirm all sandbox nodes are running consistent firmware after an upgrade.

What Can Be Monitored

CPU/memory/disk usage
analysis job status
power supply failure
HA cluster health/topology
software version
appliance model

Imported Objects

From FORTINET-CORE-MIB

FnBoolState
FnIndex
fnAdminEntry	OBJECT-TYPE
fnSysSerial	OBJECT-TYPE
fortinet	MODULE-IDENTITY

From HCNUM-TC

CounterBasedGauge64

From IF-MIB

ifEntry	OBJECT-TYPE
ifName	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetPortNumber

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-MIB

sysName

OBJECT-TYPE

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

AutonomousType
DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using fsaSysUpTime OID:

Select a Fortinet FortiSandbox threat-detection appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type fsaSysUpTime into the Find box to locate it in the OID tree, then select it and click OK. The 64bit time (in hundredths of a second) since the network management portion of the system was last re-initialized. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the value is unexpectedly low (e.g. under 10 minutes), since that indicates a recent, possibly unplanned, reboot or restart. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
fnFortiSandboxMib	1.3.6.1.4.1.12356.118			MIB module for Fortinet FortiSandbox devices.
fsaModel	1.3.6.1.4.1.12356.118.1
fsa1000D	1.3.6.1.4.1.12356.118.1.10004
fsaVM	1.3.6.1.4.1.12356.118.1.20000
fsa3000D	1.3.6.1.4.1.12356.118.1.30004
fsa3500D	1.3.6.1.4.1.12356.118.1.30005
fsa3000E	1.3.6.1.4.1.12356.118.1.30006
fsa2000E	1.3.6.1.4.1.12356.118.1.30007
fsa1000F	1.3.6.1.4.1.12356.118.1.30008
fsa500F	1.3.6.1.4.1.12356.118.1.30009
fsaTraps	1.3.6.1.4.1.12356.118.2
fsaTrapPrefix	1.3.6.1.4.1.12356.118.2.0
NTF fsaTrapMalware	1.3.6.1.4.1.12356.118.2.0.501			A malware has been detected
NTF fsaTrapCPUHigh	1.3.6.1.4.1.12356.118.2.0.502			The CPU usage is too high
NTF fsaTrapMemHigh	1.3.6.1.4.1.12356.118.2.0.503			The memory usage is too high
NTF fsaTrapDUHigh	1.3.6.1.4.1.12356.118.2.0.504			The hard drive space usage is too high
NTF fsaTrapPSUC	1.3.6.1.4.1.12356.118.2.0.505			The power supply unit state has changed
NTF fsaTrapHCT	1.3.6.1.4.1.12356.118.2.0.506			The topology map of HC has changed
NTF fsaTrapHCH	1.3.6.1.4.1.12356.118.2.0.507			The health status of HC has changed
fsaSystem	1.3.6.1.4.1.12356.118.3
fsaSystemInfo	1.3.6.1.4.1.12356.118.3.1
STR fsaSysVersion	1.3.6.1.4.1.12356.118.3.1.1	DisplayString	read-only	Firmware version of the device
G32 fsaSysCpuUsage	1.3.6.1.4.1.12356.118.3.1.2	Gauge32	read-only	Current CPU usage (percentage)
G32 fsaSysMemUsage	1.3.6.1.4.1.12356.118.3.1.3	Gauge32	read-only	Current memory utilization (percentage)
G32 fsaSysMemCapacity	1.3.6.1.4.1.12356.118.3.1.4	Gauge32	read-only	Total physical memory (RAM) installed (KB)
G32 fsaSysDiskUsage	1.3.6.1.4.1.12356.118.3.1.5	Gauge32	read-only	Current hard disk usage (MB), if disk is present
G32 fsaSysDiskCapacity	1.3.6.1.4.1.12356.118.3.1.6	Gauge32	read-only	Total hard disk capacity (MB), if disk is present
G32 fsaSysCpuUsageExcludedNice	1.3.6.1.4.1.12356.118.3.1.7	Gauge32	read-only	Current CPU usage excluded nice processes usage (percentage)
C64 fsaSysUpTimeEx	1.3.6.1.4.1.12356.118.3.1.8	Counter64	read-only	The 64bit time (in hundredths of a second) since the network management portion of the system was last re-initialized.
fsaSoftware	1.3.6.1.4.1.12356.118.3.2
STR fsaSysTracer	1.3.6.1.4.1.12356.118.3.2.1	DisplayString	read-only	Sandbox tracer engine version installed on the device
STR fsaSysRating	1.3.6.1.4.1.12356.118.3.2.2	DisplayString	read-only	Sandbox rating engine version installed on the device
STR fsaSysTool	1.3.6.1.4.1.12356.118.3.2.3	DisplayString	read-only	Sandbox system tools version installed on the device
STR fsaSysSniffer	1.3.6.1.4.1.12356.118.3.2.4	DisplayString	read-only	Traffic sniffer version installed on the device
STR fsaSysIPS	1.3.6.1.4.1.12356.118.3.2.5	DisplayString	read-only	Network alerts signature database version installed on the device
STR fsaSysAndroidA	1.3.6.1.4.1.12356.118.3.2.6	DisplayString	read-only	Android analytic engine version installed on the device
STR fsaSysAndroidR	1.3.6.1.4.1.12356.118.3.2.7	DisplayString	read-only	Android rating engine version installed on the device
fsaFwUsers	1.3.6.1.4.1.12356.118.4
fsaFwUserInfo	1.3.6.1.4.1.12356.118.4.1
I32 fsaFwUserNumber	1.3.6.1.4.1.12356.118.4.1.1	Integer32	read-only	The number of user accounts in fsaFwUserTable
I32 fsaFwUserAuthTimeout	1.3.6.1.4.1.12356.118.4.1.2	Integer32	read-only	Idle period after which a firewall-authentication user's session is automatically expired
fsaFwUserTables	1.3.6.1.4.1.12356.118.4.2
fsaFwUserTable	1.3.6.1.4.1.12356.118.4.2.1		not-accessible	A list of local and proxy (Radius server) user accounts for use with firewall user authentication
fsaFwUserEntry	1.3.6.1.4.1.12356.118.4.2.1.1		not-accessible	An entry containing information applicable to a particular user account
FNI fsaFwUserIndex	1.3.6.1.4.1.12356.118.4.2.1.1.1	FnIndex	not-accessible	An index for uniquely identifying the users in fsaFwUserTable
STR fsaFwUserName	1.3.6.1.4.1.12356.118.4.2.1.1.2	DisplayString	read-only	User-name of the specified account
FSA fsaFwUserAuth	1.3.6.1.4.1.12356.118.4.2.1.1.3	FsaUserAuthType	read-only	Type of authentication the account uses (local, RADIUS, LDAP, etc.)
FNB fsaFwUserState	1.3.6.1.4.1.12356.118.4.2.1.1.4	FnBoolState	read-only	Status of the user account (enable/disable)
fsaJobInfo	1.3.6.1.4.1.12356.118.5
fsaJobQueue	1.3.6.1.4.1.12356.118.5.1
I32 fsaFTypeExe	1.3.6.1.4.1.12356.118.5.1.1	Integer32	read-only	Pending Executables/DLL/VBS/BAT/PS1/JAR/MSI files on the device
I32 fsaFTypePDF	1.3.6.1.4.1.12356.118.5.1.2	Integer32	read-only	Pending PDF files on the device
I32 fsaFTypeDOC	1.3.6.1.4.1.12356.118.5.1.3	Integer32	read-only	Pending Office files on the device
I32 fsaFTypeFLASH	1.3.6.1.4.1.12356.118.5.1.4	Integer32	read-only	Pending Flash files on the device
I32 fsaFTypeWEB	1.3.6.1.4.1.12356.118.5.1.5	Integer32	read-only	Pending Web files on the device
I32 fsaFTypeAndroid	1.3.6.1.4.1.12356.118.5.1.6	Integer32	read-only	Pending Android files on the device
I32 fsaFTypeMAC	1.3.6.1.4.1.12356.118.5.1.7	Integer32	read-only	Pending Android files on the device
I32 fsaFTypeURL	1.3.6.1.4.1.12356.118.5.1.8	Integer32	read-only	Pending URL jobs on the device
I32 fsaFTypeExtra	1.3.6.1.4.1.12356.118.5.1.9	Integer32	read-only	Pending user defined files on the device
I32 fsaFTypeNOVM	1.3.6.1.4.1.12356.118.5.1.10	Integer32	read-only	Pending Non Sandboxing files on the device
I32 fsaFTypePre	1.3.6.1.4.1.12356.118.5.1.11	Integer32	read-only	Job Queue Assignment Pending files on the device
I32 fsaJobProcessing	1.3.6.1.4.1.12356.118.5.1.12	Integer32	read-only	Processing jobs on the device
fsaTrapObjects	1.3.6.1.4.1.12356.118.6
STR fsaTrapJobId	1.3.6.1.4.1.12356.118.6.1	DisplayString	accessible-for-notify	JOB ID of the malware identified in trap
STR fsaTrapCPUrate	1.3.6.1.4.1.12356.118.6.2	DisplayString	accessible-for-notify	CPU usage rate identified in trap
STR fsaTrapMUrate	1.3.6.1.4.1.12356.118.6.3	DisplayString	accessible-for-notify	Memory usage rate identified in trap
STR fsaTrapDUrate	1.3.6.1.4.1.12356.118.6.4	DisplayString	accessible-for-notify	Disk usage rate identified in trap
STR fsaTrapPSUFailure	1.3.6.1.4.1.12356.118.6.5	DisplayString	accessible-for-notify	Power supply state identified in trap
STR fsaTrapHCTopology	1.3.6.1.4.1.12356.118.6.6	DisplayString	accessible-for-notify	The topology map of HC identified in trap
STR fsaTrapHCHealth	1.3.6.1.4.1.12356.118.6.7	DisplayString	accessible-for-notify	The health status of HC identified in trap
fsaMibConformance	1.3.6.1.4.1.12356.118.10
fsaSystemObjectGroup	1.3.6.1.4.1.12356.118.10.1			Objects pertaining to the system status of the device.
fsaSoftwareObjectGroup	1.3.6.1.4.1.12356.118.10.2			Objects pertaining to software running on the device.
fsaUserObjectGroup	1.3.6.1.4.1.12356.118.10.3			Objects pertaining to Firewall functionality on FortiSandbox devices.
fsaJobObjectGroup	1.3.6.1.4.1.12356.118.10.4			Objects pertaining to jobs on the device.
fsaNotificationGroup	1.3.6.1.4.1.12356.118.10.5			Notifications that can be generated from a FortiSandbox device.
fsaMIBCompliance	1.3.6.1.4.1.12356.118.10.100			The compliance statement for the application MIB.

RFC description

Fortinet FortiSandbox MIB for managing sandbox security appliances with user authentication and session monitoring.

Start monitoring Fortinet FortiSandbox threat-detection appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FORTINET-FORTISANDBOX-MIB