TPT-NGFW-LOGGING-MIB

All MIBs › TPT-NGFW-LOGGING-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention

Description: Manages Trend Micro TippingPoint NGFW event logging destinations, formats, and severity filtering.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-NGFW-LOGGING-MIB?

TPT-NGFW-LOGGING-MIB is a Trend Micro, Inc. proprietary MIB defining log and audit notifications for TippingPoint Next-Generation Firewall (NGFW) products. Its system-log notification carries time/host/source/severity/text, an audit-log notification carries access type, category, IP address (type/address), category, result, user, and message, and a VPN-log notification covers VPN-specific events. As a notification MIB it lets an administrator receive detailed system, audit, and VPN log events from a TippingPoint NGFW in real time via SNMP. It is deployed on Trend Micro TippingPoint Next-Generation Firewall (NGFW) appliances. Engineers can download the TPT-NGFW-LOGGING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-NGFW-LOGGING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Trend Micro TippingPoint Next-Generation Firewall (NGFW) appliances

Monitoring Examples

An administrator receives a tptNgfwAuditLogNotify trap and reads tptNgfwAuditLogNotifyUser and tptNgfwAuditLogNotifyResult to audit a configuration change on a TippingPoint NGFW.

What Can Be Monitored

system/audit/VPN log event notifications

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
TEXTUAL-CONVENTION

From TPT-NGFW-REG-MIB

Severity
tpt-ngfw-compls
tpt-ngfw-eventsV2
tpt-ngfw-groups
tpt-ngfw-objs
tpt-ngfw-params

From TPT-NGFW-SYSTEM-INFO-MIB

tptNgfwSystemSerial

OBJECT-TYPE

OIDs

OID symbolic	OID numeric	Type	Access	Description
tptNgfwLoggingGroup	1.3.6.1.4.1.10734.3.9.1.1.9			Logging group consisting of system, audit, and VPN log objects.
tptNgfwLoggingNotificationGroup	1.3.6.1.4.1.10734.3.9.1.1.10			NGFW Logging notifications.
tptNgfwLoggingCompl	1.3.6.1.4.1.10734.3.9.1.2.3			Compliance for TippingPoint Next-generation Firewall logging MIB.
tptNgfwLogging	1.3.6.1.4.1.10734.3.9.2.5			Logging information and notifications for TippingPoint Next-Generation Firewall products. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
NTF tptNgfwSysLogNotify	1.3.6.1.4.1.10734.3.9.3.0.15			System log notification.
NTF tptNgfwAuditLogNotify	1.3.6.1.4.1.10734.3.9.3.0.16			Audit-log notification.
NTF tptNgfwVpnLogNotify	1.3.6.1.4.1.10734.3.9.3.0.17			A notification for VPN log information.
DAT tptNgfwLogNotifyTime	1.3.6.1.4.1.10734.3.9.3.1.60	DateAndTime	accessible-for-notify	The date and time when the entry was logged.
STR tptNgfwLogNotifyHost	1.3.6.1.4.1.10734.3.9.3.1.61	SnmpAdminString	accessible-for-notify	The host name that generated the system log.
STR tptNgfwLogNotifySource	1.3.6.1.4.1.10734.3.9.3.1.62	SnmpAdminString	accessible-for-notify	The component that generated the system log.
SEV tptNgfwLogNotifySeverity	1.3.6.1.4.1.10734.3.9.3.1.63	Severity	accessible-for-notify	The severity of the logged event.
STR tptNgfwLogNotifyText	1.3.6.1.4.1.10734.3.9.3.1.64	SnmpAdminString	accessible-for-notify	The full log text.
U32 tptNgfwAuditLogNotifyAccess	1.3.6.1.4.1.10734.3.9.3.1.65	Unsigned32	accessible-for-notify	The access level of the user initiating the audit check and generating the log. This is a bit field with the following mapping: 0x0 - normal 0x1 - operator 0x4 - administrator 0x8 - super-user
STR tptNgfwAuditLogNotifyType	1.3.6.1.4.1.10734.3.9.3.1.66	SnmpAdminString	accessible-for-notify	The interface source of the audit log action.
IPt tptNgfwAuditLogNotifyIpAddrType	1.3.6.1.4.1.10734.3.9.3.1.67	InetAddressType	accessible-for-notify	The type of IP address from which the user connected.
IP tptNgfwAuditLogNotifyIpAddr	1.3.6.1.4.1.10734.3.9.3.1.68	InetAddress	accessible-for-notify	The IP address from which the user connected.
AUD tptNgfwAuditLogNotifyCategory	1.3.6.1.4.1.10734.3.9.3.1.69	AuditLogCategory	accessible-for-notify	The functional area where the audit log was generated.
AUD tptNgfwAuditLogNotifyResult	1.3.6.1.4.1.10734.3.9.3.1.70	AuditLogResult	accessible-for-notify	The result, pass or fail, of an audit check.
STR tptNgfwAuditLogNotifyUser	1.3.6.1.4.1.10734.3.9.3.1.71	SnmpAdminString	accessible-for-notify	The user initiating the audit check and generating the log.
STR tptNgfwAuditLogNotifyMessage	1.3.6.1.4.1.10734.3.9.3.1.72	SnmpAdminString	accessible-for-notify	A description of what configuration change was attempted (and possibly succeeded) by the user.

RFC description

Provides logging and event notifications for TippingPoint Next-Generation Firewall systems including intrusion detection alerts.

Start monitoring Trend Micro TippingPoint Next-Generation Firewall (NGFW) appliances (system/audit/VPN log notification status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-NGFW-LOGGING-MIB

What Is TPT-NGFW-LOGGING-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description