TPT-NGFW-USER-MIB

All MIBs › TPT-NGFW-USER-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention

Description: Manages Trend Micro TippingPoint NGFW user identity mapping and authentication policy configuration.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-NGFW-USER-MIB?

TPT-NGFW-USER-MIB is a Trend Micro proprietary MIB (TippingPoint product line) covering user authentication activity on TippingPoint Next-Generation Firewall/Intrusion Prevention appliances. Its objects cover notifications for authentication failure, locked account, and locked source IP, plus the associated username, failure reason, source IP address, notification source, and lockout time. As a status/notification MIB it lets an administrator monitor user authentication activity and receive alerts when related thresholds or events occur. It is deployed on Trend Micro TippingPoint security appliances. Engineers can download the TPT-NGFW-USER-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-NGFW-USER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Trend Micro TippingPoint security appliances

Monitoring Examples

A security team monitors this MIB's user authentication activity objects/notifications to catch a TippingPoint appliance issue related to user authentication activity before it affects inline traffic inspection.

What Can Be Monitored

user authentication activity

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DateAndTime

From TPT-NGFW-REG-MIB

tpt-ngfw-compls
tpt-ngfw-eventsV2
tpt-ngfw-groups
tpt-ngfw-objs
tpt-ngfw-params
tptNgfwNotifySeverity	OBJECT-TYPE

From TPT-NGFW-SYSTEM-INFO-MIB

tptNgfwSystemSerial

OBJECT-TYPE

OIDs

OID symbolic	OID numeric	Type	Access	Description
tptNgfwUserGroup	1.3.6.1.4.1.10734.3.9.1.1.11			User group containing objects related to user stats.
tptNgfwUserNotificationGroup	1.3.6.1.4.1.10734.3.9.1.1.12			Group for all user notifications.
tptNgfwUserCompl	1.3.6.1.4.1.10734.3.9.1.2.5			Compliance group for user MIB.
tptNgfwPolicy	1.3.6.1.4.1.10734.3.9.2.4			User information for TippingPoint Next-Generation Firewall products. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
NTF tptNgfwUserAuthFailNotify	1.3.6.1.4.1.10734.3.9.3.0.18			A notification sent when a user attempts to log into the device but fails to authenticate.
NTF tptNgfwUserAuthLockedAccountNotify	1.3.6.1.4.1.10734.3.9.3.0.19			A notification sent when a user account is locked after exceeding the allowed number of login attempts.
NTF tptNgfwUserAuthLockedIpNotify	1.3.6.1.4.1.10734.3.9.3.0.20			A notification sent when too many failed login attempts occur from the same source IP address.
STR tptNgfwUserAuthName	1.3.6.1.4.1.10734.3.9.3.1.73	SnmpAdminString	accessible-for-notify	The name of a user.
STR tptNgfwUserAuthFailNotifyReason	1.3.6.1.4.1.10734.3.9.3.1.74	SnmpAdminString	accessible-for-notify	The reason for the user authentication failure.
IPt tptNgfwUserAuthSrcIpAddrType	1.3.6.1.4.1.10734.3.9.3.1.75	InetAddressType	accessible-for-notify	The type of IP address of the source IP address object.
IP tptNgfwUserAuthSrcIpAddr	1.3.6.1.4.1.10734.3.9.3.1.76	InetAddress	accessible-for-notify	The device IP from where the user attempted to authenticate.
STR tptNgfwUserAuthNotifySource	1.3.6.1.4.1.10734.3.9.3.1.77	SnmpAdminString	accessible-for-notify	The source or interface (SSH, LSM, SMS, Console) used to make an authentication attempt.
DAT tptNgfwUserAuthLockedTime	1.3.6.1.4.1.10734.3.9.3.1.78	DateAndTime	accessible-for-notify	The time a user account or IP address was locked.

RFC description

Manages user information and authentication for TippingPoint Next-Generation Firewall devices.

Start monitoring Trend Micro TippingPoint security appliances (auth-failure/account-lockout notification status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-NGFW-USER-MIB

What Is TPT-NGFW-USER-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description