TPT-POLICY-MIB

All MIBs › TPT-POLICY-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention

Description: Manages TippingPoint IPS security filter policy rules, actions, and attack protection configuration.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-POLICY-MIB?

TPT-POLICY-MIB is a Trend Micro / TippingPoint MIB (imported under the TPT-TPAMIBS-MIB tree) that exposes packet-processing and security-policy counters for TippingPoint Threat Protection Appliances. Global 32-bit and 64-bit counters (policyPacketsDropped, policyPacketsBlocked, policyPacketsIncoming, policyPacketsOutgoing, policyPacketsInvalid, policyPacketsPermitted, policyPacketsRateLimited64, policyPacketsTrusted64) track overall traffic disposition across all security policies, while policyDVVersion reports the installed Digital Vaccine (intrusion-signature) version. topTenHitsByPolicyTable ranks the ten policies with the most triggered hits (policyHitCount, policyName, policyUUID), and alertsBySeverityTable aggregates alert counts by PolicySeverity (warning, minor, major, critical) across the device. An older per-policy policyCounterTable (policyCountBytes, policyCountPackets) is now marked obsolete in favor of the top-ten and severity summary views. Because it is a statistics-only MIB layered on TippingPoint's TPA policy engine, it is deployed on TippingPoint Intrusion Prevention System (IPS) appliances for TPT-POLICY-MIB MIB based security-policy hit and traffic-disposition monitoring.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint (Trend Micro) Intrusion Prevention System appliances

Monitoring Examples

An operator polls policyPacketsBlocked64 and policyPacketsDropped64 over time alongside alertsBySeverityTable's critical-severity count to gauge attack volume, and checks topTenHitsByPolicyTable to see which signature is generating the most hits; a sudden spike in critical alerts paired with one policy dominating topTenHitsByPolicyTable would point to an active exploit attempt matching that specific signature.

What Can Be Monitored

global blocked/dropped/permitted packet counters (32- and 64-bit)
Digital Vaccine signature version
top-ten policies by hit count
alert counts by severity level
rate-limited and trusted packet counters

Imported Objects

From IPV6-TC

Ipv6Address

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

From TPT-TPAMIBS-MIB

tpt-tpa-eventsV2
tpt-tpa-objs
tpt-tpa-unkparams

How to Use in IPNetwork Monitor

Example using policyPacketsDropped OID:

Select a TippingPoint (Trend Micro) Intrusion Prevention System appliance (policy hit/traffic-disposition counter status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type policyPacketsDropped into the Find box to locate it in the OID tree, then select it and click OK. The total number of packets discarded due to network congestion. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpt_policy	1.3.6.1.4.1.10734.3.3.2.1			TPA policy counters. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
C32 policyPacketsDroppedEx	1.3.6.1.4.1.10734.3.3.2.1.1	Counter32	read-only	The total number of packets discarded due to network congestion.
C32 policyPacketsBlocked	1.3.6.1.4.1.10734.3.3.2.1.2	Counter32	read-only	The cumulative number of packets blocked because of policy actions.
C32 policyPacketsIncoming	1.3.6.1.4.1.10734.3.3.2.1.3	Counter32	read-only	The total number of incoming packets.
C32 policyPacketsOutgoing	1.3.6.1.4.1.10734.3.3.2.1.4	Counter32	read-only	The total number of outgoing packets.
policyCounterTable	1.3.6.1.4.1.10734.3.3.2.1.5		not-accessible	Table of per-policy counter values.
policyCounterEntry	1.3.6.1.4.1.10734.3.3.2.1.5.1		not-accessible	An entry in the policy counter table. Rows cannot be created or deleted.
OCT policyGlobalID	1.3.6.1.4.1.10734.3.3.2.1.5.1.1	OCTET STRING	not-accessible	The global identifier of a policy.
OCT policyDescriptiveName	1.3.6.1.4.1.10734.3.3.2.1.5.1.2	OCTET STRING	not-accessible	The human-readable name of a policy.
C64 policyCountBytes	1.3.6.1.4.1.10734.3.3.2.1.5.1.3	Counter64	not-accessible	The total number of bytes affected by the given policy.
C64 policyCountPackets	1.3.6.1.4.1.10734.3.3.2.1.5.1.4	Counter64	not-accessible	The total number of packets affected by the given policy.
U32 policyCreationTime	1.3.6.1.4.1.10734.3.3.2.1.5.1.5	Unsigned32	not-accessible	The time the policy was pushed to NetPAL, in seconds since the epoch.
C32 policyPacketsInvalid	1.3.6.1.4.1.10734.3.3.2.1.6	Counter32	read-only	The total number of packets discarded because they were invalid.
C32 policyPacketsPermitted	1.3.6.1.4.1.10734.3.3.2.1.7	Counter32	read-only	The cumulative number of packets permitted because of policy actions.
policyDVObjs	1.3.6.1.4.1.10734.3.3.2.1.10			Sub-tree of Digital Vaccine information.
OCT policyDVVersion	1.3.6.1.4.1.10734.3.3.2.1.10.1	OCTET STRING	read-only	The version number of the Digital Vaccine on this machine.
topTenHitsByPolicyTable	1.3.6.1.4.1.10734.3.3.2.1.11		not-accessible	Table of policies with the ten greatest hit counts.
topTenHitsByPolicyEntry	1.3.6.1.4.1.10734.3.3.2.1.11.1		not-accessible	An entry in the top ten policies table. Rows cannot be created or deleted.
U32 topTenRank	1.3.6.1.4.1.10734.3.3.2.1.11.1.1	Unsigned32	read-only	The numerical ranking 1 through 10 of a policy.
U32 policyHitCount	1.3.6.1.4.1.10734.3.3.2.1.11.1.2	Unsigned32	read-only	The count of alerts generated by a policy.
OCT policyName	1.3.6.1.4.1.10734.3.3.2.1.11.1.3	OCTET STRING	read-only	The human-readable name of a policy.
OCT policyUUID	1.3.6.1.4.1.10734.3.3.2.1.11.1.4	OCTET STRING	read-only	The global identifier of a policy.
alertsBySeverityTable	1.3.6.1.4.1.10734.3.3.2.1.12		not-accessible	Table of alert counts of all policies at each severity level.
alertsBySeverityEntry	1.3.6.1.4.1.10734.3.3.2.1.12.1		not-accessible	An entry in the alerts by severity table. Rows cannot be created or deleted.
POL alertSeverity	1.3.6.1.4.1.10734.3.3.2.1.12.1.1	PolicySeverity	read-only	The severity of a policy.
U32 severityAlertCount	1.3.6.1.4.1.10734.3.3.2.1.12.1.2	Unsigned32	read-only	The count of alerts generated by all policies of a given severity.
alertsByProtocolTable	1.3.6.1.4.1.10734.3.3.2.1.13		not-accessible	Table of alert counts of all policies at each protocol.
alertsByProtocolEntry	1.3.6.1.4.1.10734.3.3.2.1.13.1		not-accessible	An entry in the alerts by protocol table. Rows cannot be created or deleted.
POL alertProtocol	1.3.6.1.4.1.10734.3.3.2.1.13.1.1	PolicyProtocol	read-only	The protocol of a policy.
U32 protocolAlertCount	1.3.6.1.4.1.10734.3.3.2.1.13.1.2	Unsigned32	read-only	The count of alerts generated by all policies of a given protocol.
alertsByZoneTable	1.3.6.1.4.1.10734.3.3.2.1.14		not-accessible	Table of alert counts of all policies for each zone.
alertsByZoneEntry	1.3.6.1.4.1.10734.3.3.2.1.14.1		not-accessible	An entry in the alerts by zone table. Rows cannot be created or deleted.
U32 alertSlot	1.3.6.1.4.1.10734.3.3.2.1.14.1.1	Unsigned32	not-accessible	The slot portion identifying the zone affected by a policy.
U32 alertPort	1.3.6.1.4.1.10734.3.3.2.1.14.1.2	Unsigned32	not-accessible	The port portion identifying the zone affected by a policy.
U32 zoneAlertCount	1.3.6.1.4.1.10734.3.3.2.1.14.1.3	Unsigned32	read-only	The count of alerts generated by all policies of a given zone.
permitsByZoneTable	1.3.6.1.4.1.10734.3.3.2.1.15		not-accessible	Table of permit counts of all policies for each zone.
permitsByZoneEntry	1.3.6.1.4.1.10734.3.3.2.1.15.1		not-accessible	An entry in the permits by zone table. Rows cannot be created or deleted.
U32 permitSlot	1.3.6.1.4.1.10734.3.3.2.1.15.1.1	Unsigned32	not-accessible	The slot portion identifying the zone affected by a policy.
U32 permitPort	1.3.6.1.4.1.10734.3.3.2.1.15.1.2	Unsigned32	not-accessible	The port portion identifying the zone affected by a policy.
U32 zonePermitCount	1.3.6.1.4.1.10734.3.3.2.1.15.1.3	Unsigned32	read-only	The count of permits generated by all policies of a given zone.
blocksByZoneTable	1.3.6.1.4.1.10734.3.3.2.1.16		not-accessible	Table of block counts of all policies for each zone.
blocksByZoneEntry	1.3.6.1.4.1.10734.3.3.2.1.16.1		not-accessible	An entry in the blocks by zone table. Rows cannot be created or deleted.
U32 blockSlot	1.3.6.1.4.1.10734.3.3.2.1.16.1.1	Unsigned32	not-accessible	The slot portion identifying the zone affected by a policy.
U32 blockPort	1.3.6.1.4.1.10734.3.3.2.1.16.1.2	Unsigned32	not-accessible	The port portion identifying the zone affected by a policy.
U32 zoneBlockCount	1.3.6.1.4.1.10734.3.3.2.1.16.1.3	Unsigned32	read-only	The count of blocks generated by all policies of a given zone.
p2psByZoneTable	1.3.6.1.4.1.10734.3.3.2.1.17		not-accessible	Table of p2p counts of all policies for each zone.
p2psByZoneEntry	1.3.6.1.4.1.10734.3.3.2.1.17.1		not-accessible	An entry in the p2ps by zone table. Rows cannot be created or deleted.
U32 p2pSlot	1.3.6.1.4.1.10734.3.3.2.1.17.1.1	Unsigned32	not-accessible	The slot portion identifying the zone affected by a policy.
U32 p2pPort	1.3.6.1.4.1.10734.3.3.2.1.17.1.2	Unsigned32	not-accessible	The port portion identifying the zone affected by a policy.
U32 zoneP2pCount	1.3.6.1.4.1.10734.3.3.2.1.17.1.3	Unsigned32	read-only	The count of p2ps generated by all policies of a given zone.
framesBySizeTable	1.3.6.1.4.1.10734.3.3.2.1.18		not-accessible	Table of frame counts received in each size category.
framesBySizeEntry	1.3.6.1.4.1.10734.3.3.2.1.18.1		not-accessible	An entry in the frames by size table. Rows cannot be created or deleted.
POL frameSize	1.3.6.1.4.1.10734.3.3.2.1.18.1.1	PolicyFrameSize	read-only	The size category of a frame.
U32 sizeFrameCount	1.3.6.1.4.1.10734.3.3.2.1.18.1.2	Unsigned32	read-only	The count of frames received in a given size category.
framesByTypeTable	1.3.6.1.4.1.10734.3.3.2.1.19		not-accessible	Table of frame counts received in each type classification.
framesByTypeEntry	1.3.6.1.4.1.10734.3.3.2.1.19.1		not-accessible	An entry in the frames by type table. Rows cannot be created or deleted.
POL frameType	1.3.6.1.4.1.10734.3.3.2.1.19.1.1	PolicyFrameType	read-only	The type classification (e.g., unicast, broadcast, FCS error) of a frame.
U32 typeFrameCount	1.3.6.1.4.1.10734.3.3.2.1.19.1.2	Unsigned32	read-only	The count of frames received in a given type classification.
packetsByProtocolTable	1.3.6.1.4.1.10734.3.3.2.1.20		not-accessible	Table of packet counts received for each protocol.
packetsByProtocolEntry	1.3.6.1.4.1.10734.3.3.2.1.20.1		not-accessible	An entry in the packets by protocol table. Rows cannot be created or deleted.
POL packetProtocol	1.3.6.1.4.1.10734.3.3.2.1.20.1.1	PolicyProtocol	read-only	The protocol of a policy.
U32 protocolPacketCount	1.3.6.1.4.1.10734.3.3.2.1.20.1.2	Unsigned32	read-only	The count of packets received for a given protocol.
policyByNumberTable	1.3.6.1.4.1.10734.3.3.2.1.21		not-accessible	Table of packet counts received for each protocol.
policyByNumberEntry	1.3.6.1.4.1.10734.3.3.2.1.21.1		not-accessible	An entry in the policy by number table. Rows cannot be created or deleted.
U32 policyNumber	1.3.6.1.4.1.10734.3.3.2.1.21.1.1	Unsigned32	not-accessible	The number of a policy.
OCT numberName	1.3.6.1.4.1.10734.3.3.2.1.21.1.2	OCTET STRING	read-only	The name of a policy.
OCT numberDesc	1.3.6.1.4.1.10734.3.3.2.1.21.1.3	OCTET STRING	read-only	The description of a policy.
securityZonePairTable	1.3.6.1.4.1.10734.3.3.2.1.22		not-accessible	Table of information and statistics for each security zone pair.
securityZonePairEntry	1.3.6.1.4.1.10734.3.3.2.1.22.1		not-accessible	An entry in the security zone pair table. Rows cannot be created or deleted.
OCT szpName	1.3.6.1.4.1.10734.3.3.2.1.22.1.1	OCTET STRING	read-only	The name of a security zone pair.
OCT szpInZoneName	1.3.6.1.4.1.10734.3.3.2.1.22.1.2	OCTET STRING	read-only	The name of the input security zone of a security zone pair.
OCT szpOutZoneName	1.3.6.1.4.1.10734.3.3.2.1.22.1.3	OCTET STRING	read-only	The name of the output security zone of a security zone pair.
OCT szpUUID	1.3.6.1.4.1.10734.3.3.2.1.22.1.4	OCTET STRING	read-only	The UUID of a security zone pair.
OCT szpInZoneUUID	1.3.6.1.4.1.10734.3.3.2.1.22.1.5	OCTET STRING	read-only	The UUID of the input security zone of a security zone pair.
OCT szpOutZoneUUID	1.3.6.1.4.1.10734.3.3.2.1.22.1.6	OCTET STRING	read-only	The UUID of the output security zone of a security zone pair.
C64 szpInPackets	1.3.6.1.4.1.10734.3.3.2.1.22.1.7	Counter64	read-only	The number of packets received on this security zone pair.
C64 szpInOctets	1.3.6.1.4.1.10734.3.3.2.1.22.1.8	Counter64	read-only	The number of bytes received on this security zone pair.
C64 szpAlerts	1.3.6.1.4.1.10734.3.3.2.1.22.1.9	Counter64	read-only	The number of alerts (blocks + permits) on this security zone pair.
C64 szpBlocks	1.3.6.1.4.1.10734.3.3.2.1.22.1.10	Counter64	read-only	The number of blocks generated on this security zone pair.
C64 szpPermits	1.3.6.1.4.1.10734.3.3.2.1.22.1.11	Counter64	read-only	The number of permits generated on this security zone pair.
U32 szpPrecedence	1.3.6.1.4.1.10734.3.3.2.1.22.1.12	Unsigned32	read-only	The precedence of security zone pair.
portStatsTable	1.3.6.1.4.1.10734.3.3.2.1.23		not-accessible	Table of statistics for each physical port.
portStatsEntry	1.3.6.1.4.1.10734.3.3.2.1.23.1		not-accessible	An entry in the port statistics table. Rows cannot be created or deleted.
U32 portNumber	1.3.6.1.4.1.10734.3.3.2.1.23.1.1	Unsigned32	not-accessible	The numeric index of a port.
OCT portName	1.3.6.1.4.1.10734.3.3.2.1.23.1.2	OCTET STRING	read-only	The name of a port.
C64 portVlanTranslations	1.3.6.1.4.1.10734.3.3.2.1.23.1.3	Counter64	read-only	Number of packets leaving this egress port whose VLAN IDs were translated.
C64 policyPacketsDropped64	1.3.6.1.4.1.10734.3.3.2.1.31	Counter64	read-only	The total number of packets discarded due to network congestion.
C64 policyPacketsBlocked64	1.3.6.1.4.1.10734.3.3.2.1.32	Counter64	read-only	The cumulative number of packets blocked because of policy actions.
C64 policyPacketsIncoming64	1.3.6.1.4.1.10734.3.3.2.1.33	Counter64	read-only	The total number of incoming packets.
C64 policyPacketsOutgoing64	1.3.6.1.4.1.10734.3.3.2.1.34	Counter64	read-only	The total number of outgoing packets.
C64 policyPacketsInvalid64	1.3.6.1.4.1.10734.3.3.2.1.36	Counter64	read-only	The total number of packets discarded because they were invalid.
C64 policyPacketsPermitted64	1.3.6.1.4.1.10734.3.3.2.1.37	Counter64	read-only	The total number of packets permitted because of policy actions.
C64 policyPacketsRateLimited64	1.3.6.1.4.1.10734.3.3.2.1.38	Counter64	read-only	The total number of packets discarded by rate limiting filters.
C64 policyPacketsTrusted64	1.3.6.1.4.1.10734.3.3.2.1.39	Counter64	read-only	The cumulative number of packets trusted because of policy actions.
NTF tptPolicyNotify	1.3.6.1.4.1.10734.3.3.3.0.8			Notification: Used to inform the management station of a policy alert action (either deny or allow) resulting from a signature match.
NTF tptPolicyLogNotify	1.3.6.1.4.1.10734.3.3.3.0.19			Notification: Used to inform the management station that some number of policy log entries of a particular type (alert, block, or peer) occurred since the last time the management station retrieved the corresponding log file.
NTF tptPolicySslInspNotify	1.3.6.1.4.1.10734.3.3.3.0.27			A notification sent when an action is taken on a SSL connection.
OCT tptPolicyNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.11	OCTET STRING	read-only	The unique identifier of the device sending this notification.
OCT tptPolicyNotifyPolicyID	1.3.6.1.4.1.10734.3.3.3.1.12	OCTET STRING	read-only	The unique identifier of the policy causing this notification.
OCT tptPolicyNotifySignatureID	1.3.6.1.4.1.10734.3.3.3.1.13	OCTET STRING	read-only	The unique identifier of the signature matching the incoming data stream.
OCT tptPolicyNotifySegmentName	1.3.6.1.4.1.10734.3.3.3.1.14	OCTET STRING	read-only	A string of the format : that uniquely identifies the segment pertaining to this notification.
IP tptPolicyNotifySrcNetAddr	1.3.6.1.4.1.10734.3.3.3.1.15	IpAddress	read-only	The network address of the source of the packet(s) triggering the policy action.
U32 tptPolicyNotifySrcNetPort	1.3.6.1.4.1.10734.3.3.3.1.16	Unsigned32	read-only	The network port (if applicable) of the source of the packet(s) triggering the policy action.
IP tptPolicyNotifyDestNetAddr	1.3.6.1.4.1.10734.3.3.3.1.17	IpAddress	read-only	The network address of the destination of the packet(s) triggering the policy action.
U32 tptPolicyNotifyDestNetPort	1.3.6.1.4.1.10734.3.3.3.1.18	Unsigned32	read-only	The network port (if applicable) of the destination of the packet(s) triggering the policy action.
U32 tptPolicyNotifyStartTimeSec	1.3.6.1.4.1.10734.3.3.3.1.19	Unsigned32	read-only	The time of the first policy hit, marking the start of the aggregation period for this notification (in seconds since January 1, 1970).
POL tptPolicyNotifyAlertAction	1.3.6.1.4.1.10734.3.3.3.1.20	PolicyAction	read-only	The action associated with this notification: whether the affected packets were actually blocked, allowed through, or rate-limited.
POL tptPolicyNotifyConfigAction	1.3.6.1.4.1.10734.3.3.3.1.21	PolicyAction	read-only	The action configured for the policy, which in some cases may differ from the action associated with this notification.
POL tptPolicyNotifyComponentID	1.3.6.1.4.1.10734.3.3.3.1.22	PolicyComponent	read-only	The component identifier of the policy causing this notification.
U32 tptPolicyNotifyHitCount	1.3.6.1.4.1.10734.3.3.3.1.23	Unsigned32	read-only	The number of policy hits occurring during the aggregation period for this notification.
U32 tptPolicyNotifyAggregationPeriod	1.3.6.1.4.1.10734.3.3.3.1.24	Unsigned32	read-only	The duration (in minutes) of the aggregation period for this notification.
POL tptPolicyNotifySeverity	1.3.6.1.4.1.10734.3.3.3.1.25	PolicySeverity	read-only	The severity of the attack for this notification.
OCT tptPolicyNotifyProtocol	1.3.6.1.4.1.10734.3.3.3.1.26	OCTET STRING	read-only	The network protocol of the packet(s) triggering the policy action.
U32 tptPolicyNotifyAlertTimeSec	1.3.6.1.4.1.10734.3.3.3.1.27	Unsigned32	read-only	The time this alert was initiated, marking the end of the aggregation period for this notification (in seconds since January 1, 1970).
U32 tptPolicyNotifyAlertTimeNano	1.3.6.1.4.1.10734.3.3.3.1.28	Unsigned32	read-only	The nanoseconds portion of tptPolicyNotifyAlertTimeSec.
I32 tptPolicyNotifyPacketTrace	1.3.6.1.4.1.10734.3.3.3.1.29	Integer32	read-only	The value 1 if a corresponding packet trace was logged; 0 if not.
C64 tptPolicyNotifySequence	1.3.6.1.4.1.10734.3.3.3.1.30	Counter64	read-only	The log file entry sequence number corresponding to this notification.
U32 tptPolicyNotifyTraceBucket	1.3.6.1.4.1.10734.3.3.3.1.36	Unsigned32	read-only	The bucket identifier for a packet trace.
U32 tptPolicyNotifyTraceBegin	1.3.6.1.4.1.10734.3.3.3.1.37	Unsigned32	read-only	The starting sequence number for a packet trace.
U32 tptPolicyNotifyTraceEnd	1.3.6.1.4.1.10734.3.3.3.1.38	Unsigned32	read-only	The ending sequence number for a packet trace.
OCT tptPolicyNotifyMessageParams	1.3.6.1.4.1.10734.3.3.3.1.39	OCTET STRING	read-only	A string containing parameters (separated by vertical bars) matching the Message in the Digital Vaccine (the XML tag is Message).
U32 tptPolicyNotifyStartTimeNano	1.3.6.1.4.1.10734.3.3.3.1.40	Unsigned32	read-only	The nanoseconds portion of tptPolicyNotifyStartTimeSec.
U32 tptPolicyNotifyAlertType	1.3.6.1.4.1.10734.3.3.3.1.41	Unsigned32	read-only	A bit field defined as follows: 0x0001 = Alert 0x0002 = Block 0x0020 = Peer-to-peer 0x0040 = Invalid 0x0080 = Threshold 0x0100 = Management.
U32 tptPolicyNotifyInputMphy	1.3.6.1.4.1.10734.3.3.3.1.57	Unsigned32	read-only	The physical input port of the triggering packet(s).
U32 tptPolicyNotifyVlanTag	1.3.6.1.4.1.10734.3.3.3.1.58	Unsigned32	read-only	The VLAN tag of the triggering packet(s).
OCT tptPolicyNotifyZonePair	1.3.6.1.4.1.10734.3.3.3.1.59	OCTET STRING	read-only	A string of the format : that identifies the zone pair pertaining to this notification.
OCT tptPolicyLogNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.121	OCTET STRING	read-only	The unique identifier of the device sending this notification.
POL tptPolicyLogNotifyComponentID	1.3.6.1.4.1.10734.3.3.3.1.122	PolicyComponent	read-only	The type of log (alert, block, or peer) pertaining to this notification.
U32 tptPolicyLogNotifyNumber	1.3.6.1.4.1.10734.3.3.3.1.123	Unsigned32	read-only	The number of policy log entries since the last SMS log file retrieval.
U32 tptPolicyLogNotifyTrigger	1.3.6.1.4.1.10734.3.3.3.1.124	Unsigned32	read-only	The number of policy log entries needed to trigger this notification.
C64 tptPolicyLogNotifySequence	1.3.6.1.4.1.10734.3.3.3.1.125	Counter64	read-only	The current log file entry sequence number.
ADR tptPolicyNotifySrcNetAddrV6	1.3.6.1.4.1.10734.3.3.3.1.128	Ipv6Address	read-only	The IPv6 network address of the source of the packet(s) triggering the policy action.
ADR tptPolicyNotifyDestNetAddrV6	1.3.6.1.4.1.10734.3.3.3.1.129	Ipv6Address	read-only	The IPv6 network address of the destination of the packet(s) triggering the policy action.
OCT tptPolicyNotifyActionSetID	1.3.6.1.4.1.10734.3.3.3.1.130	OCTET STRING	read-only	The action set uuid associated with this notification.
I32 tptPolicyNotifyRate	1.3.6.1.4.1.10734.3.3.3.1.131	Integer32	read-only	The rate-limit, in kbps, of the action set associated with this notification.
OCT tptPolicyNotifyFlowControl	1.3.6.1.4.1.10734.3.3.3.1.137	OCTET STRING	read-only	The action set flow control associated with this notification.
OCT tptPolicyNotifyActionSetName	1.3.6.1.4.1.10734.3.3.3.1.138	OCTET STRING	read-only	The action set name associated with this notification.
OCT tptPolicyNotifyClientip	1.3.6.1.4.1.10734.3.3.3.1.139	OCTET STRING	read-only	The client-ip associated with this notification.
OCT tptPolicyNotifyMetadata	1.3.6.1.4.1.10734.3.3.3.1.140	OCTET STRING	read-only	The metadata associated with this notification.
SSL tptPolicyNotifySslInspected	1.3.6.1.4.1.10734.3.3.3.1.180	SslInspectedFlag	read-only	A flag indicting if the notification is associated with an inspected SSL data stream. This flag is only present on IPS and Quarantine events and doesn't apply to Reputation.
STR tptPolicyNotifyVirtualSegment	1.3.6.1.4.1.10734.3.3.3.1.182	SnmpAdminString	accessible-for-notify	Virtual segment associated with this notification.
SSL tptPolicyNotifySslInspEventType	1.3.6.1.4.1.10734.3.3.3.1.190	SslInspEventType	accessible-for-notify	The SSL connection type.
SSL tptPolicyNotifySslInspAction	1.3.6.1.4.1.10734.3.3.3.1.191	SslInspAction	accessible-for-notify	The SSL connection action taken.
STR tptPolicyNotifySslInspDetails	1.3.6.1.4.1.10734.3.3.3.1.192	SnmpAdminString	accessible-for-notify	Free-form field that provides additional details for the action taken on a SSL connection.
STR tptPolicyNotifySslInspPolicy	1.3.6.1.4.1.10734.3.3.3.1.193	SnmpAdminString	accessible-for-notify	The SSL inspection policy.
STR tptPolicyNotifySslInspCert	1.3.6.1.4.1.10734.3.3.3.1.194	SnmpAdminString	accessible-for-notify	The certificate used to decrypt SSL traffic.
STR tptPolicyNotifySslInspCltIF	1.3.6.1.4.1.10734.3.3.3.1.195	SnmpAdminString	accessible-for-notify	The client-side interface receiving SSL traffic.
SSL tptPolicyNotifySslInspCltSslVer	1.3.6.1.4.1.10734.3.3.3.1.196	SslProtocol	accessible-for-notify	The client-side SSL protocol version.
STR tptPolicyNotifySslInspCltCrypto	1.3.6.1.4.1.10734.3.3.3.1.197	SnmpAdminString	accessible-for-notify	The client-side SSL crypto-suite.
STR tptPolicyNotifySslInspSrvIF	1.3.6.1.4.1.10734.3.3.3.1.198	SnmpAdminString	accessible-for-notify	The server-side interface sending SSL traffic.
SSL tptPolicyNotifySslInspSrvSslVer	1.3.6.1.4.1.10734.3.3.3.1.199	SslProtocol	accessible-for-notify	The server-side SSL protocol version.
STR tptPolicyNotifySslInspSrvCrypto	1.3.6.1.4.1.10734.3.3.3.1.200	SnmpAdminString	accessible-for-notify	The server-side SSL crypto-suite.

RFC description

Manages TPA (Trend Micro security product) policy counters and traffic inspection statistics. Provides policy-level network security metrics and notifications.

Start monitoring TippingPoint (Trend Micro) Intrusion Prevention System appliances (policy hit/traffic-disposition counter status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-POLICY-MIB