MCAFEE-MWG-MIB

All MIBs › MCAFEE-MWG-MIB

Organization: McAfee Inc.

Last Updated: 2014-11-10

Category: Domain: Security, Vendor: McAfee

Description: McAfee Web Gateway (MWG) SNMP MIB defining management objects for monitoring proxy traffic, policy, and security events.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is MCAFEE-MWG-MIB?

This is a McAfee (Skyhigh) private MIB for the McAfee Web Gateway (MWG), a secure web proxy appliance that inspects and filters HTTP/HTTPS traffic for malware, policy violations, and data loss. It exposes management objects covering proxy traffic statistics, policy enforcement counters, and security event notifications generated by the gateway's scanning engine. Its monitoring value centers on software/service status of the gateway itself: traffic throughput and connection counts reveal load and potential bottlenecks, while security event counters (malware blocks, policy violations) indicate active threat activity requiring review. It is a self-contained appliance MIB, generally used alongside standard host-resource MIBs (for CPU/memory/disk on the underlying appliance) since MCAFEE-MWG-MIB itself focuses on proxy-application-layer metrics. It is deployed at enterprise network edges or in cloud secure web gateway deployments, where security teams rely on MCAFEE-MWG-MIB SNMP monitoring for real-time visibility into web traffic filtering and threat detection.

IPNetwork Monitor allows you to monitor SNMP objects defined in MCAFEE-MWG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

McAfee Web Gateway appliance

Monitoring Examples

A security operations team would poll traffic and policy-violation counters to spot a spike in blocked malware downloads, potentially indicating a compromised endpoint repeatedly attempting outbound callbacks. Proxy connection/session counters would be watched for unusual load that could indicate a misconfigured client or a denial-of-service condition against the gateway. Security event trap objects would typically feed a SIEM to correlate web-layer threats with other security telemetry.

What Can Be Monitored

proxy traffic volume/connections
policy violation counts
malware/security event counts
gateway scanning engine activity

Imported Objects

From MCAFEE-SMI

mcafeeGATEWAY

OBJECT-IDENTITY

From RFC-1215

TRAP-TYPE

From RFC1155-SMI

enterprises

From RFC1213-MIB

DisplayString
PhysAddress

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32
mib-2

How to Use in IPNetwork Monitor

Example using stMalwareDetected OID:

Select a McAfee Web Gateway appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type stMalwareDetected into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of infections detected by the McAfee Gateway Antimalware Engine. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
I32 kBuildNumber	1.3.6.1.4.1.1230.2.7.1.10	Integer32	read-only	BUILD number
STR kCompanyName	1.3.6.1.4.1.1230.2.7.1.2	DisplayString	read-only	Company holding the copyright on this product
I32 kCustomVersion	1.3.6.1.4.1.1230.2.7.1.8	Integer32	read-only	Custom version number
I32 kHotfixVersion	1.3.6.1.4.1.1230.2.7.1.7	Integer32	read-only	Hotfix version number
I32 kMajorVersion	1.3.6.1.4.1.1230.2.7.1.4	Integer32	read-only	Major version number
I32 kMicroVersion	1.3.6.1.4.1.1230.2.7.1.6	Integer32	read-only	Micro version number
I32 kMinorVersion	1.3.6.1.4.1.1230.2.7.1.5	Integer32	read-only	Minor version number
STR kProductName	1.3.6.1.4.1.1230.2.7.1.1	DisplayString	read-write	Product name
STR kProductVersion	1.3.6.1.4.1.1230.2.7.1.3	DisplayString	read-only	String representation of the product version
STR kRevision	1.3.6.1.4.1.1230.2.7.1.9	DisplayString	read-only	SVN revision number
mwg	1.3.6.1.4.1.1230.2.7			McAfee Web Gateway 7.5 MIB definitions
mwgContent	1.3.6.1.4.1.1230.2.7.2.1
mwgEngineVersions	1.3.6.1.4.1.1230.2.7.1.20
mwgFTP	1.3.6.1.4.1.1230.2.7.2.4
mwgHttp	1.3.6.1.4.1.1230.2.7.2.2
mwgHttps	1.3.6.1.4.1.1230.2.7.2.3
mwgInfo	1.3.6.1.4.1.1230.2.7.1
mwgMiscellaneous	1.3.6.1.4.1.1230.2.7.2.5
mwgStatistics	1.3.6.1.4.1.1230.2.7.2
mwgTraps	1.3.6.1.4.1.1230.2.7.4
mwgTrapVariables	1.3.6.1.4.1.1230.2.7.4.10
OCT notifyAdditional	1.3.6.1.4.1.1230.2.7.4.10.7	OCTET STRING	read-only	Additional information string
IP notifyAffectedHost	1.3.6.1.4.1.1230.2.7.4.10.6	IpAddress	read-only	Additional information if a remote host was involved in this message
I32 notifyOrigin	1.3.6.1.4.1.1230.2.7.4.10.1	Integer32	read-only	Origin from where the notification has been send
OCT notifyOriginName	1.3.6.1.4.1.1230.2.7.4.10.2	OCTET STRING	read-only	Name of the origin of the trap
I32 notifyReason	1.3.6.1.4.1.1230.2.7.4.10.4	Integer32	read-only	Code to identify the notification
OCT notifyReasonString	1.3.6.1.4.1.1230.2.7.4.10.5	OCTET STRING	read-only	Human readable string for the notification
INT notifySeverity	1.3.6.1.4.1.1230.2.7.4.10.3	INTEGER	read-only	Severity of this notification
STR pAMEngineVersion	1.3.6.1.4.1.1230.2.7.1.20.1	DisplayString	read-only	Version of the McAfee Anti-Malware Engine for Gateway
STR pAMProactiveVersion	1.3.6.1.4.1.1230.2.7.1.20.5	DisplayString	read-only	Version of the ProActive database
STR pAMSignatureVersion	1.3.6.1.4.1.1230.2.7.1.20.2	DisplayString	read-only	Version of the McAfee Anti-Malware Signature File (obsolete)
STR pMFEDATVersion	1.3.6.1.4.1.1230.2.7.1.20.4	DisplayString	read-only	Version of the McAfee DATs
STR pMFEEngineVersion	1.3.6.1.4.1.1230.2.7.1.20.3	DisplayString	read-only	Version of the McAfee Anti-Malware Engine
STR pTSDBVersion	1.3.6.1.4.1.1230.2.7.1.20.6	DisplayString	read-only	Version of McAfee TrustedSource
C64 stBadReputation	1.3.6.1.4.1.1230.2.7.2.1.1	Counter64	read-only	This statistic value is obsolete and should no longer be used
C64 stBlockedByAntiMalware	1.3.6.1.4.1.1230.2.7.2.1.4	Counter64	read-only	Number of connections blocked by Anti-Malware
C64 stBlockedByMediaFilter	1.3.6.1.4.1.1230.2.7.2.1.6	Counter64	read-only	Number of connections that have been blocked by the Media-Type filter
C64 stBlockedByURLFilter	1.3.6.1.4.1.1230.2.7.2.1.7	Counter64	read-only	Number of connection that have been blocked by the URL filter
C64 stCategories	1.3.6.1.4.1.1230.2.7.2.1.9	Counter64	read-only	Number of categories detected by the URL filter
stCategoriesEntry	1.3.6.1.4.1.1230.2.7.2.1.10.1		not-accessible	An entry containing information about a categorys name and counter.
stCategoriesTable	1.3.6.1.4.1.1230.2.7.2.1.10		not-accessible	A table containing the categories detected by the URL filter
C64 stCategoryCount	1.3.6.1.4.1.1230.2.7.2.1.10.1.2	Counter64	read-only	Number of times the URL filter detected this category
STR stCategoryName	1.3.6.1.4.1.1230.2.7.2.1.10.1.1	DisplayString	read-only	Name of the category
C64 stClientCount	1.3.6.1.4.1.1230.2.7.2.5.2	Counter64	read-only	Currently connected clients
C64 stConnectedSockets	1.3.6.1.4.1.1230.2.7.2.5.3	Counter64	read-only	Number of open network sockets in use by the proxy
C64 stConnectionsBlocked	1.3.6.1.4.1.1230.2.7.2.1.5	Counter64	read-only	Number of blocked connections
C64 stConnectionsLegitimate	1.3.6.1.4.1.1230.2.7.2.1.3	Counter64	read-only	Number of connections that not have been blocked
C64 stCPUIOWait	1.3.6.1.4.1.1230.2.7.2.5.5	Counter64	read-only	I/O wait value in percent
C64 stCPULoad	1.3.6.1.4.1.1230.2.7.2.5.1	Counter64	read-only	Current overall CPU usage in percent
C64 stCPULoadRaw	1.3.6.1.4.1.1230.2.7.2.5.4	Counter64	read-only	Load value 1 minute average
C64 stFirstSentFirstReceivedClient	1.3.6.1.4.1.1230.2.7.2.5.10	Counter64	read-only	First byte received from client until first byte sent back
C64 stFirstSentFirstReceivedServer	1.3.6.1.4.1.1230.2.7.2.5.12	Counter64	read-only	First byte sent to server until first byte received
C64 stFtpBytesFromClient	1.3.6.1.4.1.1230.2.7.2.4.2	Counter64	read-only	Number of bytes tranferred from proxy to client(s) using the FTP protocol
C64 stFtpBytesFromServer	1.3.6.1.4.1.1230.2.7.2.4.3	Counter64	read-only	Number of bytes tranferred from server(s) to proxy using the FTP protocol
C64 stFtpBytesToClient	1.3.6.1.4.1.1230.2.7.2.4.4	Counter64	read-only	Number of bytes tranferred from proxy to client(s) using the FTP protocol
C64 stFtpBytesToServer	1.3.6.1.4.1.1230.2.7.2.4.5	Counter64	read-only	Number of bytes tranferred from proxy to server(s) using the FTP protocol
C64 stFtpTraffic	1.3.6.1.4.1.1230.2.7.2.4.1	Counter64	read-only	Number of bytes transmitted between proxy and server(s) using the FTP protocol
C64 stHandleConnectToServer	1.3.6.1.4.1.1230.2.7.2.5.9	Counter64	read-only	Connect to Server
C64 stHttpBytesFromClient	1.3.6.1.4.1.1230.2.7.2.2.3	Counter64	read-only	Number of bytes transferred from client to proxy using the HTTP protocol
C64 stHttpBytesFromServer	1.3.6.1.4.1.1230.2.7.2.2.4	Counter64	read-only	Number of bytes transferred from server to proxy using the HTTP protocol
C64 stHttpBytesToClient	1.3.6.1.4.1.1230.2.7.2.2.5	Counter64	read-only	Number of bytes transferred from proxy to client(s) using the HTTP protocol
C64 stHttpBytesToServer	1.3.6.1.4.1.1230.2.7.2.2.6	Counter64	read-only	Number of bytes transferred from proxy to server(s) using the HTTP protocol
C64 stHttpRequests	1.3.6.1.4.1.1230.2.7.2.2.1	Counter64	read-only	Number of HTTP requests
C64 stHttpsBytesFromClient	1.3.6.1.4.1.1230.2.7.2.3.3	Counter64	read-only	Number of bytes tranferred from client(s) to proxy using the HTTPS protocol
C64 stHttpsBytesFromServer	1.3.6.1.4.1.1230.2.7.2.3.4	Counter64	read-only	Number of bytes tranferred from server(s) to proxy using the HTTPS protocol
C64 stHttpsBytesToClient	1.3.6.1.4.1.1230.2.7.2.3.5	Counter64	read-only	Number of bytes tranferred from proxy to client(s) and proxy using the HTTPS protocol
C64 stHttpsBytesToServer	1.3.6.1.4.1.1230.2.7.2.3.6	Counter64	read-only	Number of bytes tranferred from proxy to server(s) and proxy using the HTTPS protocol
C64 stHttpsRequests	1.3.6.1.4.1.1230.2.7.2.3.1	Counter64	read-only	Number of HTTPS requests
C64 stHttpsTraffic	1.3.6.1.4.1.1230.2.7.2.3.2	Counter64	read-only	Number of bytes tranferred between proxy and server(s) using the HTTPS protocol
C64 stHttpTraffic	1.3.6.1.4.1.1230.2.7.2.2.2	Counter64	read-only	Number of bytes tranferred between proxy and server(s) using the HTTP protocol
C64 stLastSentFirstReceivedServer	1.3.6.1.4.1.1230.2.7.2.5.14	Counter64	read-only	Last byte sent to server until first byte received
C64 stLastSentLastReceivedClient	1.3.6.1.4.1.1230.2.7.2.5.11	Counter64	read-only	Last byte received from client until last byte sent back
C64 stLastSentLastReceivedServer	1.3.6.1.4.1.1230.2.7.2.5.13	Counter64	read-only	Last byte sent to server until last byte received
C64 stMalwareDetectedEx	1.3.6.1.4.1.1230.2.7.2.1.2	Counter64	read-only	Number of infections detected by the McAfee Gateway Antimalware Engine
C64 stMemConsumed	1.3.6.1.4.1.1230.2.7.2.5.15	Counter64	read-only	Virtual memory consumption of the main processes divided by RAM + half of SWAP space. Projected to 0-100.
C64 stMimeType	1.3.6.1.4.1.1230.2.7.2.1.8	Counter64	read-only	Number of media types detected by the Media Type filter
C64 stResolveHostViaDNS	1.3.6.1.4.1.1230.2.7.2.5.6	Counter64	read-only	Time to resolve DNS in ms
C64 stTimeConsumedByRuleEngine	1.3.6.1.4.1.1230.2.7.2.5.7	Counter64	read-only	Average time used by the rule engine in ms
C64 stTimeForTransaction	1.3.6.1.4.1.1230.2.7.2.5.8	Counter64	read-only	Average time for transaction in ms
NTF trApplication	1.3.6.1.4.1.1230.2.7.4.2			Traps that are generated by an application system event
NTF trSystem	1.3.6.1.4.1.1230.2.7.4.1			Traps that are generated by a system event
NTF trUser	1.3.6.1.4.1.1230.2.7.4.3			User defined trap that indicates an event connected to a client IP

RFC description

Monitors McAfee Web Gateway performance including HTTP/HTTPS/FTP statistics and threat protection metrics.

Start monitoring McAfee Web Gateway appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download MCAFEE-MWG-MIB