STORMSHIELD-SERVICES-MIB

All MIBs › STORMSHIELD-SERVICES-MIB

Organization: Stormshield

Last Updated: 2017-02-20

Category: Firewall / Security Appliance, Stormshield

Description: Monitors Stormshield firewall security service status including proxy, antivirus, and IDS engine state.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is STORMSHIELD-SERVICES-MIB?

STORMSHIELD-SERVICES-MIB is a proprietary Stormshield MIB reporting the operational status of individual security service engines running on the vendor's firewall/UTM appliance, such as the proxy service, antivirus scanning engine, and intrusion detection/prevention (IDS/IPS) engine. It exposes service-level status data - essentially whether each protective service is running, stopped, or in an error state - making it a software/service-status monitoring module rather than a hardware or interface-focused one. Its core monitoring use is to confirm that critical security services are actually active, since a stopped antivirus or IDS engine would leave traffic unprotected despite the appliance otherwise passing traffic normally. No explicit dependency is stated, though it naturally complements the other Stormshield MIBs (auth users, auto-update, IPsec stats) for a full security-posture picture. Typical deployment is on Stormshield UTM/firewall appliances where administrators want SNMP-based confirmation that all licensed security services are running. Engineers can download the STORMSHIELD-SERVICES-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in STORMSHIELD-SERVICES-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Stormshield firewall/UTM appliance

Monitoring Examples

No sample object or table names were provided for this module; based on the short description, a realistic use would be polling per-service status objects for the proxy, antivirus, and IDS/IPS engines to confirm each is in a running state, catching a scenario where the antivirus engine has silently stopped after a signature update failure, leaving traffic unscanned.

What Can Be Monitored

proxy service status
antivirus engine status
IDS/IPS engine status

Imported Objects

From RFC1213-MIB

DisplayString

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From STORMSHIELD-SMI-MIB

stormshieldMIB

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using snsServicesState OID:

Select a Stormshield firewall/UTM appliance (security-service engine status: proxy/AV/IDS-IPS) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type snsServicesState into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the state value can be 0/1 according as the service is down/up. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than '1 (up)', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
snsServices	1.3.6.1.4.1.11256.1.7			stormshield services
snsServicesTable	1.3.6.1.4.1.11256.1.7.1		not-accessible	List of running services
snsServicesEntry	1.3.6.1.4.1.11256.1.7.1.1		not-accessible	Each entry in the snsServicesTable holds a set of information (Service name, status, and uptime).
INT snsServicesIndex	1.3.6.1.4.1.11256.1.7.1.1.1	INTEGER	read-only	A unique value for the table. Its value ranges between 1 and 65535 and may not be contigous. the index has no other meaning but a pure index
STR snsServicesName	1.3.6.1.4.1.11256.1.7.1.1.2	SnmpAdminString	read-only	Service name
I32 snsServicesStateEx	1.3.6.1.4.1.11256.1.7.1.1.3	Integer32	read-only	State value can be 0/1 according as the service is down/up
I32 snsServicesUptime	1.3.6.1.4.1.11256.1.7.1.1.4	Integer32	read-only	Uptime

RFC description

Monitors running services on Stormshield security appliances, tracking service status and uptime information.

Start monitoring Stormshield firewall/UTM appliance (security-service engine status: proxy/AV/IDS-IPS) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download STORMSHIELD-SERVICES-MIB