TPT-TSE-MIB

All MIBs › TPT-TSE-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention

Description: Manages TippingPoint IPS traffic service engine inspection queues, rules, and processing statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-TSE-MIB?

TPT-TSE-MIB is a Trend Micro TippingPoint MIB covering the Threat Suppression Engine (TSE), the core inspection engine of TippingPoint IPS appliances. It exposes configuration and performance data for adaptive filters and connection blocking: filter names, UUIDs, network segment, enabled state, associated signature ID and profile, plus tables of currently blocked connections. Its monitoring value spans both software status (which filters are active/enabled) and operational/performance status (top adaptive filters by rank, active connection blocks), letting administrators see what the inspection engine is actively enforcing and blocking in real time. It is closely related to TPT-NPSTATS-MIB, since network-processor statistics reflect the load generated by these same filters. It is deployed in enterprise and carrier security operations centers monitoring live IPS enforcement activity on TippingPoint appliances, and security teams can get a TPT-TSE-MIB download to load directly into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-TSE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint (Trend Micro) IPS appliance

Monitoring Examples

An admin would poll topTenAdaptFilterTable/topTenAdaptFilterEntry (topTenAdaptFilterRank, adaptFilterName, adaptFilterEnabledState, adaptFilterSigID) to see which adaptive filters are most active and confirm they remain enabled as expected. The connectionBlockTable/connectionBlockEntry (indexed by connectionBlockIndex) would be checked to see currently blocked connections, revealing active threat mitigation in progress. An adaptive filter unexpectedly showing a disabled adaptFilterEnabledState would indicate a gap in threat coverage for that signature.

What Can Be Monitored

top adaptive filters by activity rank
adaptive filter enabled/disabled state
adaptive filter signature ID and profile
currently blocked connections

Imported Objects

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

From TPT-TPAMIBS-MIB

tpt-tpa-objs

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpt_tse	1.3.6.1.4.1.10734.3.3.2.7			Threat Suppression Engine information. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
topTenAdaptFilterTable	1.3.6.1.4.1.10734.3.3.2.7.1		not-accessible	Adaptive filter configuration top ten list.
topTenAdaptFilterEntry	1.3.6.1.4.1.10734.3.3.2.7.1.1		not-accessible	An entry in the adaptive filter configuration top ten list. Rows cannot be created or deleted.
U32 topTenAdaptFilterRank	1.3.6.1.4.1.10734.3.3.2.7.1.1.1	Unsigned32	read-only	The numerical ranking 1 through 10 in the adaptive filter top ten list.
OCT adaptFilterName	1.3.6.1.4.1.10734.3.3.2.7.1.1.2	OCTET STRING	read-only	The human-readable name of a filter in the adaptive filter top ten list.
OCT adaptFilterUUID	1.3.6.1.4.1.10734.3.3.2.7.1.1.3	OCTET STRING	read-only	The global identifier of a filter in the adaptive filter top ten list.
OCT adaptFilterSegment	1.3.6.1.4.1.10734.3.3.2.7.1.1.4	OCTET STRING	read-only	The applicable segment of a filter in the adaptive filter top ten list.
POL adaptFilterEnabledState	1.3.6.1.4.1.10734.3.3.2.7.1.1.5	PolicyState	read-only	The state of a filter in the adaptive filter top ten list.
OCT adaptFilterSigID	1.3.6.1.4.1.10734.3.3.2.7.1.1.7	OCTET STRING	read-only	The global identifier of a signature in the adaptive filter top ten list.
OCT adaptFilterProfile	1.3.6.1.4.1.10734.3.3.2.7.1.1.8	OCTET STRING	read-only	The profile name of a filter in the adaptive filter top ten list.
connectionBlockTable	1.3.6.1.4.1.10734.3.3.2.7.2		not-accessible	Table of connections corresponding to blocked streams.
connectionBlockEntry	1.3.6.1.4.1.10734.3.3.2.7.2.1		not-accessible	An entry in the connection block table. Rows cannot be created or deleted.
U32 connectionBlockIndex	1.3.6.1.4.1.10734.3.3.2.7.2.1.1	Unsigned32	not-accessible	An index into the table of connections corresponding to blocked streams.
OCT connectionBlockSrcAddr	1.3.6.1.4.1.10734.3.3.2.7.2.1.2	OCTET STRING	read-only	The source IP address of a connection.
U32 connectionBlockSrcPort	1.3.6.1.4.1.10734.3.3.2.7.2.1.3	Unsigned32	read-only	The source port of a connection.
OCT connectionBlockDestAddr	1.3.6.1.4.1.10734.3.3.2.7.2.1.4	OCTET STRING	read-only	The destination IP address of a connection.
U32 connectionBlockDestPort	1.3.6.1.4.1.10734.3.3.2.7.2.1.5	Unsigned32	read-only	The destination port of a connection.
OCT connectionBlockProtocol	1.3.6.1.4.1.10734.3.3.2.7.2.1.6	OCTET STRING	read-only	The transmission protocol of a connection.
OCT connectionBlockPort	1.3.6.1.4.1.10734.3.3.2.7.2.1.7	OCTET STRING	read-only	The name of the security zone pair whose incoming data caused the block.
OCT connectionBlockReason	1.3.6.1.4.1.10734.3.3.2.7.2.1.8	OCTET STRING	read-only	The UUID of the signature that caused the block.
OCT connectionBlockSrcAddrV6	1.3.6.1.4.1.10734.3.3.2.7.2.1.9	OCTET STRING	read-only	The source IPv6 address of a connection.
OCT connectionBlockDestAddrV6	1.3.6.1.4.1.10734.3.3.2.7.2.1.10	OCTET STRING	read-only	The destination IPv6 address of a connection.
U32 connectionBlockTotalCount	1.3.6.1.4.1.10734.3.3.2.7.3	Unsigned32	read-only	The total number of connections corresponding to blocked streams. Only the first 50 are contained in the connection block table.
rateLimitStreamTable	1.3.6.1.4.1.10734.3.3.2.7.4		not-accessible	Table of rate limit streams.
rateLimitStreamEntry	1.3.6.1.4.1.10734.3.3.2.7.4.1		not-accessible	An entry in the rate limit stream table. Rows cannot be created or deleted.
U32 rateLimitStreamIndex	1.3.6.1.4.1.10734.3.3.2.7.4.1.1	Unsigned32	not-accessible	An index into the rate limit stream table.
OCT rateLimitStreamSrcAddr	1.3.6.1.4.1.10734.3.3.2.7.4.1.2	OCTET STRING	read-only	The source IP address of a rate limit.
U32 rateLimitStreamSrcPort	1.3.6.1.4.1.10734.3.3.2.7.4.1.3	Unsigned32	read-only	The source port of a rate limit.
OCT rateLimitStreamDestAddr	1.3.6.1.4.1.10734.3.3.2.7.4.1.4	OCTET STRING	read-only	The destination IP address of a rate limit.
U32 rateLimitStreamDestPort	1.3.6.1.4.1.10734.3.3.2.7.4.1.5	Unsigned32	read-only	The destination port of a rate limit.
OCT rateLimitStreamProtocol	1.3.6.1.4.1.10734.3.3.2.7.4.1.6	OCTET STRING	read-only	The transmission protocol of a rate limit.
OCT rateLimitStreamPort	1.3.6.1.4.1.10734.3.3.2.7.4.1.7	OCTET STRING	read-only	The port on which the stream originated.
OCT rateLimitStreamReason	1.3.6.1.4.1.10734.3.3.2.7.4.1.8	OCTET STRING	read-only	The UUID of the rate limiter.
OCT rateLimitStreamSrcAddrV6	1.3.6.1.4.1.10734.3.3.2.7.4.1.9	OCTET STRING	read-only	The source IPv6 address of a rate limit.
OCT rateLimitStreamDestAddrV6	1.3.6.1.4.1.10734.3.3.2.7.4.1.10	OCTET STRING	read-only	The destination IPv6 address of a rate limit.
U32 rateLimitStreamTotalCount	1.3.6.1.4.1.10734.3.3.2.7.5	Unsigned32	read-only	The total number of rate limit streams. Only the first 50 are contained in the rate limit stream table.
connectionTrustTable	1.3.6.1.4.1.10734.3.3.2.7.6		not-accessible	Table of connections corresponding to trusted streams.
connectionTrustEntry	1.3.6.1.4.1.10734.3.3.2.7.6.1		not-accessible	An entry in the connection trust table. Rows cannot be created or deleted.
U32 connectionTrustIndex	1.3.6.1.4.1.10734.3.3.2.7.6.1.1	Unsigned32	not-accessible	An index into the table of connections corresponding to trusted streams.
OCT connectionTrustSrcAddr	1.3.6.1.4.1.10734.3.3.2.7.6.1.2	OCTET STRING	read-only	The source IP address of a trusted connection.
U32 connectionTrustSrcPort	1.3.6.1.4.1.10734.3.3.2.7.6.1.3	Unsigned32	read-only	The source port of a trusted connection.
OCT connectionTrustDestAddr	1.3.6.1.4.1.10734.3.3.2.7.6.1.4	OCTET STRING	read-only	The destination IP address of a trusted connection.
U32 connectionTrustDestPort	1.3.6.1.4.1.10734.3.3.2.7.6.1.5	Unsigned32	read-only	The destination port of a trusted connection.
OCT connectionTrustProtocol	1.3.6.1.4.1.10734.3.3.2.7.6.1.6	OCTET STRING	read-only	The transmission protocol of a trusted connection.
OCT connectionTrustPort	1.3.6.1.4.1.10734.3.3.2.7.6.1.7	OCTET STRING	read-only	The name of the security zone pair whose incoming data caused the trust.
OCT connectionTrustReason	1.3.6.1.4.1.10734.3.3.2.7.6.1.8	OCTET STRING	read-only	The UUID of the signature that caused the trust.
OCT connectionTrustSrcAddrV6	1.3.6.1.4.1.10734.3.3.2.7.6.1.9	OCTET STRING	read-only	The source IPv6 address of a trusted connection.
OCT connectionTrustDestAddrV6	1.3.6.1.4.1.10734.3.3.2.7.6.1.10	OCTET STRING	read-only	The destination IPv6 address of a trusted connection.
U32 connectionTrustTotalCount	1.3.6.1.4.1.10734.3.3.2.7.7	Unsigned32	read-only	The total number of connections corresponding to trusted streams. Only the first 50 are contained in the connection trust table.

RFC description

Trend Micro Threat Suppression Engine MIB providing threat detection and suppression system information.

Start monitoring TippingPoint (Trend Micro) IPS appliance (Threat Suppression Engine filter/block-list status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-TSE-MIB

What Is TPT-TSE-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description