Intelligent Sandbox supports SNMP version 2c and version 3. To enable users to manage Intelligent Sandbox resources efficiently, the SNMP service obtains integral values through SNMP traps.
Intelligent Sandbox supports the 1.3.6.1.4.1.8962.4.1.1 OID (object identifier).
Intelligent Sandbox also provide SNMP support to standard .1.3.6.1.2.1.1 OID subtree, which includes sysName, sysDecr, sysContact, and sysLocation fields to identify the resource. The sysName value is taken from Intelligent Sandbox hostname configured by "set appliance name <hostname>" command execution.
The qualified attributes for SNMP traps include:
Hard disk utilization
CPU utilization
Memory utilization
ATD services such as system health, load balancers, and malware interface status.
Other statuses such as DXL channel, TAXII, and sensor.
Log on to Intelligent Sandbox web interface.
Click → → .
Select Allow SNMP Monitoring, to configure SNMP.
Intelligent Sandbox allows you to configure the following SNMP versions:
SNMPv2c
SNMPv3
If you want to set up SNMPv2c, then select SNMPv2c, and enter the Community String for your Intelligent Sandbox appliance.
The default Community String is
atdpublic.If you want to set up SNMPv3, then select SNMPv3, then do the following:
Enter the username, then select the appropriate Security Level and Authentication type.
Enter the Authentication Password and Privacy Password.
In the SNMP System Information section, enter these fields:
Description – The field value is saved as sysDescr.
Contact – The field value is saved as sysContact.
Location – The field value is saved as sysLocation.
Note
For the Load Balancer configuration, these fields must be defined on each node individually.
To configure SNMP Traps, select Send SNMP Traps, then do the following:
Note
CPU Utilization field appearing in the SNMP Setting page is different from CPU Load featuring under System Health in the Dashboard tab.
Enter the Destination IP and Port Number.
Then choose the SNMP traps that you'd want to collect.
Category
Option
Definition
Device
Hard Disk Utilization
Trap is generated when:
Var disk partition utilization exceeds the configured threshold limit.
Data disk partition utilization exceeds the configured threshold limit.
CPU Utilization
Traps are sent when the overall CPU utilization of the device exceeds the configured threshold value.
Memory Utilization
Traps are sent when the overall Memory utilization of the device exceeds the configured threshold value.
TIS Services
System Health
The follows trap value is sent:
0 – If System Health is Bad.
1 – if System Health is Good.
Tip
System Health is flagged as Bad when any one of the critical services is down.
Backup Scheduler
The follows trap value is sent:
0 – if Backup file creation fails or FTP of backup file to server fails.
1 – if backup scheduler runs successfully.
Load Balancer
The follows trap value is sent:
0 – device is in standalone mode
1 – LB status is DOWN
2 – LB status is UP
3 – Nodes status is SW VERSION MISMATCH
4 – Primary Node LB services are not UP
5 – SCP failed
6 – VM Creation failed
7 – Invalid status
Email Connector
The follows trap value is sent:
0 – Email Connector status is DISABLED
1 – Email Connector status is Enabled and Email Connector health is GOOD
2 – Email Connector health is DEGRADED
3 – Email Connector health is OVERLOADED
Email Gateway Wait time
Trap is sent with value 1 when the Wait Time for McAfee Email Gateway exceeds the configured threshold value set in Global Settings.
Malware Interface Status
The follows trap value is sent:
0 – malware interface status is DOWN.
1 – malware interface status is UP.
License Status
The follows trap value is sent from Virtual Intelligent Sandbox:
1 – License is VALID
2 – License is INVALID
3 – License is EXPIRED
Malware DNS Status
The following trap value is sent:
0 – Malware DNS status is DOWN.
1 – Malware DNS status is UP.
Point Products
DXL Status
The follows trap value is sent:
0 – Last attempt to send TIE report failed.
1 – Last attempt to send TIE report was successful.
TAXII Status
The follows trap value is sent:
0 – Last attempt to send TAXII report failed.
1 – Last attempt to send TAXII report was successful.
2 – STIX report sent is not yet received.
Sensor Status
The follows trap value is sent for NSP Sensor status:
0 – Sensor status is INACTIVE.
1 – Sensor status is ACTIVE.
2 – Sensor status is NOT CONNECTED.
Click Submit.
What to do next
Ensure that you download the latest management information base (MIB) file using from MIB Download link on the SNMP Configuration page. Then upload the file to your SNMP MIB browser.
To retrieve the attribute numeric values, enter the
snmpgetcommand in the command prompt or any MIB browser.