TPT-MISC-NOTIFY-MIB

All MIBs › TPT-MISC-NOTIFY-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention, System Logging and Diagnostics

Description: Defines TippingPoint IPS miscellaneous notification trap objects for operational event alerting.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-MISC-NOTIFY-MIB?

TPT-MISC-NOTIFY-MIB is a Trend Micro TippingPoint IPS (intrusion prevention system) MIB defining a grab-bag of SNMP notification (trap) objects that didn't fit into the product's other, more structured MIBs, covering log/data file rollover events and network discovery scan events. It exposes fault/event-category data rather than continuous counters: rollover notifications describing which log file type rolled over and how many files exist, and discovery-scan notifications describing scan identity, scanned segment/range, and the delta of new, changed, or unchanged hosts found. Its monitoring value is squarely about operational software status — alerting an administrator when the IPS's internal log rotation occurs (so log retention/capacity can be tracked) and when a network discovery scan completes with new or changed hosts (indicating topology drift that may need security policy review). It is a TippingPoint-specific notification module used alongside the vendor's other TPT-* device and stacking MIBs rather than a general IETF standard. It is deployed wherever TippingPoint IPS appliances are managed centrally, feeding these traps into a security or network management console. Engineers can download the TPT-MISC-NOTIFY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-MISC-NOTIFY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint IPS appliance

Monitoring Examples

An administrator watching tptRolloverNotifyFileType, tptRolloverNotifyMaxFiles, and tptRolloverNotifyNumFiles would be alerted when a log file type on the IPS rolls over and how close it is to its configured maximum file count, helping catch log retention or disk-capacity issues before old data is overwritten. Separately, tptDiscoveryNotifyScanID together with tptDiscoveryNotifyNewHosts and tptDiscoveryNotifyChanged would fire after a network discovery scan, revealing that new or altered hosts appeared on a monitored segment (tptDiscoveryNotifySegmentName) since the last scan (tptDiscoveryNotifyDelta) — a signal worth investigating for unauthorized devices.

What Can Be Monitored

log file rollover events
log file count vs. maximum
discovery scan completion
new/changed/unchanged host counts
scanned segment/range identity

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From IPV6-TC

Ipv6Address

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter64
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
TEXTUAL-CONVENTION

From TPT-POLICY-MIB

SslInspectedFlag

From TPT-TPAMIBS-MIB

tpt-tpa-eventsV2
tpt-tpa-objs
tpt-tpa-unkparams

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpt_misc_notify	1.3.6.1.4.1.10734.3.3.2.2			Notification definitions that have no other place to call home. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
NTF tptManagedNotify	1.3.6.1.4.1.10734.3.3.3.0.9			Notification: Used to inform the management station that the device is now being managed by said management station.
NTF tptUnmanagedNotify	1.3.6.1.4.1.10734.3.3.3.0.10			Notification: Used to inform the management station that the device is no longer being managed by said management station.
NTF tptRolloverNotify	1.3.6.1.4.1.10734.3.3.3.0.11			Notification: Used to inform the management station that a log file has rolled over.
NTF tptDiscoveryNotifyStartStop	1.3.6.1.4.1.10734.3.3.3.0.12			Notification: Used to inform the management station that a network discovery scan has started or stopped.
NTF tptDiscoveryNotifyNewHost	1.3.6.1.4.1.10734.3.3.3.0.13			Notification: Used to inform the management station that a previously unknown host was discovered by a scan.
NTF tptSystemLogNotify	1.3.6.1.4.1.10734.3.3.3.0.16			Notification: Used to inform the management station that a critical, error, or warning message has been logged.
NTF tptQuarantineNotify	1.3.6.1.4.1.10734.3.3.3.0.20			Notification: Used to inform the management station that a host has been either added to or removed from the quarantine list.
NTF tptCongestionThresholdNotify	1.3.6.1.4.1.10734.3.3.3.0.25			Notification: Used to inform the management station that the device-wide congestion has exceeded the configured congestion threshold.
NTF tptiTier3CongestionThresholdNotify	1.3.6.1.4.1.10734.3.3.3.0.26			Notification: Used to inform the management station that the tier3 congestion has exceeded the configured congestion threshold.
NTF tptAuditLogNotify	1.3.6.1.4.1.10734.3.3.3.0.60			Audit-log notification.
NTF tptAuditLogCapacityNotify	1.3.6.1.4.1.10734.3.3.3.0.61			Notification: Used to inform the management station that audit log file size has reached more than 75 percent.
NTF tptLoggingFailureNotify	1.3.6.1.4.1.10734.3.3.3.0.62			Notification: Used to inform the management station that logging has failed.
OCT tptMiscNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.31	OCTET STRING	read-only	The unique identifier of the device sending this notification.
LOG tptRolloverNotifyFileType	1.3.6.1.4.1.10734.3.3.3.1.32	LogFileType	read-only	The type of the file that has rolled over.
U32 tptRolloverNotifyMaxFiles	1.3.6.1.4.1.10734.3.3.3.1.33	Unsigned32	read-only	The maximum number of files maintained for this log file type.
U32 tptRolloverNotifyNumFiles	1.3.6.1.4.1.10734.3.3.3.1.34	Unsigned32	read-only	The number of files that have rolled over.
U32 tptRolloverNotifyTime	1.3.6.1.4.1.10734.3.3.3.1.35	Unsigned32	read-only	The rollover time of the most recent file pertaining to this notification (in seconds since January 1, 1970).
OCT tptDiscoveryNotifyScanID	1.3.6.1.4.1.10734.3.3.3.1.42	OCTET STRING	read-only	The unique identifier of the scan pertaining to this notification.
OCT tptDiscoveryNotifySegmentName	1.3.6.1.4.1.10734.3.3.3.1.43	OCTET STRING	read-only	The name of the scanned segment pertaining to this notification.
OCT tptDiscoveryNotifyScanRange	1.3.6.1.4.1.10734.3.3.3.1.44	OCTET STRING	read-only	The network address range requested in the scan pertaining to this notification.
DIS tptDiscoveryNotifyDelta	1.3.6.1.4.1.10734.3.3.3.1.45	DiscoveryDelta	read-only	An indication of whether discovery results changed from the previous scan. Undefined if this notification signifies the start of a scan.
I32 tptDiscoveryNotifyNewHosts	1.3.6.1.4.1.10734.3.3.3.1.46	Integer32	read-only	The number of new hosts found by this scan (compared to the previous scan). Undefined if this notification signifies the start of a scan.
I32 tptDiscoveryNotifyChanged	1.3.6.1.4.1.10734.3.3.3.1.47	Integer32	read-only	The number of hosts for which this scan found different results from the previous scan. Undefined if this notification signifies the start of a scan.
I32 tptDiscoveryNotifyUnchanged	1.3.6.1.4.1.10734.3.3.3.1.48	Integer32	read-only	The number of existing hosts for which this scan found the same results (compared to the previous scan). Undefined if this notification signifies the start of a scan.
I32 tptDiscoveryNotifyNotFound	1.3.6.1.4.1.10734.3.3.3.1.49	Integer32	read-only	The number of hosts found by the previous scan but not by this scan. Undefined if this notification signifies the start of a scan.
I32 tptDiscoveryNotifyUnknown	1.3.6.1.4.1.10734.3.3.3.1.50	Integer32	read-only	The number of addresses scanned where no host was found and for which there was no previous scan data. Undefined if this notification signifies the start of a scan.
U32 tptDiscoveryNotifyStartTime	1.3.6.1.4.1.10734.3.3.3.1.51	Unsigned32	read-only	The start time of the scan pertaining to this notification (in seconds since January 1, 1970).
U32 tptDiscoveryNotifyStopTime	1.3.6.1.4.1.10734.3.3.3.1.52	Unsigned32	read-only	The stop time of the scan pertaining to this notification (in seconds since January 1, 1970). A zero value indicates that this notification signifies the start of a scan.
OCT tptDiscoveryNotifyErrorText	1.3.6.1.4.1.10734.3.3.3.1.53	OCTET STRING	read-only	If the current scan terminated abnormally, this string describes the error condition. Otherwise, an empty string.
IP tptDiscoveryNotifyHostNetAddr	1.3.6.1.4.1.10734.3.3.3.1.54	IpAddress	read-only	The network address of the newly discovered host.
OCT tptDiscoveryNotifyHostDeviceID	1.3.6.1.4.1.10734.3.3.3.1.55	OCTET STRING	read-only	The unique identifier of the newly discovered host.
OCT tptDiscoveryNotifySchedID	1.3.6.1.4.1.10734.3.3.3.1.56	OCTET STRING	read-only	For a notification resulting from a scheduled scan, this value holds the scheduled scan identifier. Otherwise, this value is undefined.
OCT tptSystemLogNotifyText	1.3.6.1.4.1.10734.3.3.3.1.92	OCTET STRING	read-only	The text of the message being logged.
C64 tptSystemLogNotifySequence	1.3.6.1.4.1.10734.3.3.3.1.93	Counter64	read-only	The log file entry sequence number corresponding to this notification.
SYS tptSystemLogNotifySeverity	1.3.6.1.4.1.10734.3.3.3.1.94	SystemLogSeverity	read-only	The severity of the attack for this notification.
U32 tptSystemLogNotifyTimeSec	1.3.6.1.4.1.10734.3.3.3.1.95	Unsigned32	read-only	The time this message was logged (in seconds since January 1, 1970).
U32 tptSystemLogNotifyTimeNano	1.3.6.1.4.1.10734.3.3.3.1.96	Unsigned32	read-only	The nanoseconds portion of tptSystemLogNotifyTimeSec.
IP tptQuarantineNotifyHostNetAddr	1.3.6.1.4.1.10734.3.3.3.1.132	IpAddress	read-only	The network address of the host being quarantined (or removed).
OCT tptQuarantineNotifyReason	1.3.6.1.4.1.10734.3.3.3.1.133	OCTET STRING	read-only	The reason that a host was quarantined (undefined if action is remove).
OCT tptQuarantineNotifySegmentName	1.3.6.1.4.1.10734.3.3.3.1.134	OCTET STRING	read-only	A string of the format : that uniquely identifies the segment pertaining to this notification.
ADD tptQuarantineNotifyAction	1.3.6.1.4.1.10734.3.3.3.1.135	AddOrRemove	read-only	Whether the host was added to or removed from the quarantine list.
ADR tptQuarantineNotifyHostNetAddrV6	1.3.6.1.4.1.10734.3.3.3.1.136	Ipv6Address	read-only	The IPv6 network address of the host being quarantined (or removed).
U32 tptCongestionPacketLoss	1.3.6.1.4.1.10734.3.3.3.1.153	Unsigned32	read-only	The current packet loss rate per thousand (percent * 10).
CON tptCongestionNotifyPhase	1.3.6.1.4.1.10734.3.3.3.1.154	CongestionThresholdPhase	read-only	Whether entering, continuing, or exiting congestion threshold mode.
U32 tptCongestionThreshold	1.3.6.1.4.1.10734.3.3.3.1.155	Unsigned32	read-only	The current packet loss threshold per thousand (percent * 10).
U32 tptTier3CongestionPacketLoss	1.3.6.1.4.1.10734.3.3.3.1.156	Unsigned32	read-only	The current tier3 packet loss rate per thousand (percent * 10).
CON tptTier3CongestionNotifyPhase	1.3.6.1.4.1.10734.3.3.3.1.157	CongestionThresholdPhase	read-only	Whether entering, continuing, or exiting tier3 congestion threshold mode.
U32 tptTier3CongestionThreshold	1.3.6.1.4.1.10734.3.3.3.1.158	Unsigned32	read-only	The current tier3 packet loss threshold per thousand (percent * 10).
DAT tptAuditLogNotifyTime	1.3.6.1.4.1.10734.3.3.3.1.170	DateAndTime	accessible-for-notify	The date and time when the entry was logged.
U32 tptAuditLogNotifyAccess	1.3.6.1.4.1.10734.3.3.3.1.171	Unsigned32	accessible-for-notify	The access level of the user initiating the audit check and generating the log. This is a bit field with the following mapping: 0x0 - normal 0x1 - operator 0x4 - administrator 0x8 - super-user
STR tptAuditLogNotifyType	1.3.6.1.4.1.10734.3.3.3.1.172	SnmpAdminString	accessible-for-notify	The interface source of the audit log action.
IPt tptAuditLogNotifyIpAddrType	1.3.6.1.4.1.10734.3.3.3.1.173	InetAddressType	accessible-for-notify	The type of IP address from which the user connected.
IP tptAuditLogNotifyIpAddr	1.3.6.1.4.1.10734.3.3.3.1.174	InetAddress	accessible-for-notify	The IP address from which the user connected.
AUD tptAuditLogNotifyCategory	1.3.6.1.4.1.10734.3.3.3.1.175	AuditLogCategory	accessible-for-notify	The functional area where the audit log was generated.
AUD tptAuditLogNotifyResult	1.3.6.1.4.1.10734.3.3.3.1.176	AuditLogResult	accessible-for-notify	The result, pass or fail, of an audit check.
STR tptAuditLogNotifyUser	1.3.6.1.4.1.10734.3.3.3.1.177	SnmpAdminString	accessible-for-notify	The user initiating the audit check and generating the log.
OCT tptAuditLogNotifyMessage	1.3.6.1.4.1.10734.3.3.3.1.178	OCTET STRING	accessible-for-notify	A description of what configuration change was attempted (and possibly succeeded) by the user.
SSL tptQuarantineNotifySslInspected	1.3.6.1.4.1.10734.3.3.3.1.181	SslInspectedFlag	read-only	Flag indicating if this quarantine action was performed on an inspected SSL data stream.
U32 tptAuditLogCapacityNotifyPercent	1.3.6.1.4.1.10734.3.3.3.1.201	Unsigned32	read-only	The time of this notification (in seconds since January 1, 1970).
U32 tptAuditLogCapacityOrFailureNotifyTime	1.3.6.1.4.1.10734.3.3.3.1.202	Unsigned32	read-only	The time of this notification (in seconds since January 1, 1970).

RFC description

Defines miscellaneous notification traps for Tipping Point network security devices; vendor-private MIB for security event reporting.

Start monitoring TippingPoint IPS appliance (log-rollover/discovery-scan notification status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-MISC-NOTIFY-MIB

What Is TPT-MISC-NOTIFY-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description