Configure SNMP setting

Prev Next

Intelligent Sandbox supports SNMP version 2c and version 3. To enable users to manage Intelligent Sandbox resources efficiently, the SNMP service obtains integral values through SNMP traps.

Intelligent Sandbox supports the 1.3.6.1.4.1.8962.4.1.1 OID (object identifier).

Intelligent Sandbox also provide SNMP support to standard .1.3.6.1.2.1.1 OID subtree, which includes sysName, sysDecr, sysContact, and sysLocation fields to identify the resource. The sysName value is taken from Intelligent Sandbox hostname configured by "set appliance name <hostname>" command execution.

The qualified attributes for SNMP traps include:

  • Hard disk utilization

  • CPU utilization

  • Memory utilization

  • ATD services such as system health, load balancers, and malware interface status.

  • Other statuses such as DXL channel, TAXII, and sensor.

  1. Log on to Intelligent Sandbox web interface.

  2. Click ManageTIS ConfigurationSNMP.

  3. Select Allow SNMP Monitoring, to configure SNMP.

    Intelligent Sandbox allows you to configure the following SNMP versions:

    • SNMPv2c

    • SNMPv3

  4. If you want to set up SNMPv2c, then select SNMPv2c, and enter the Community String for your Intelligent Sandbox appliance.

    The default Community String is atdpublic.

  5. If you want to set up SNMPv3, then select SNMPv3, then do the following:

    1. Enter the username, then select the appropriate Security Level and Authentication type.

    2. Enter the Authentication Password and Privacy Password.

  6. In the SNMP System Information section, enter these fields:

    • Description – The field value is saved as sysDescr.

    • Contact – The field value is saved as sysContact.

    • Location – The field value is saved as sysLocation.

    Note

    For the Load Balancer configuration, these fields must be defined on each node individually.

  7. To configure SNMP Traps, select Send SNMP Traps, then do the following:

    Note

    CPU Utilization field appearing in the SNMP Setting page is different from CPU Load featuring under System Health in the Dashboard tab.

    1. Enter the Destination IP and Port Number.

    2. Then choose the SNMP traps that you'd want to collect.

      Category

      Option

      Definition

      Device

      Hard Disk Utilization

      Trap is generated when:

      • Var disk partition utilization exceeds the configured threshold limit.

      • Data disk partition utilization exceeds the configured threshold limit.

      CPU Utilization

      Traps are sent when the overall CPU utilization of the device exceeds the configured threshold value.

      Memory Utilization

      Traps are sent when the overall Memory utilization of the device exceeds the configured threshold value.

      TIS Services

      System Health

      The follows trap value is sent:

      • 0 – If System Health is Bad.

      • 1 – if System Health is Good.

      Tip

      System Health is flagged as Bad when any one of the critical services is down.

      Backup Scheduler

      The follows trap value is sent:

      • 0 – if Backup file creation fails or FTP of backup file to server fails.

      • 1 – if backup scheduler runs successfully.

      Load Balancer

      The follows trap value is sent:

      • 0 – device is in standalone mode

      • 1 – LB status is DOWN

      • 2 – LB status is UP

      • 3 – Nodes status is SW VERSION MISMATCH

      • 4 – Primary Node LB services are not UP

      • 5 – SCP failed

      • 6 – VM Creation failed

      • 7 – Invalid status

      Email Connector

      The follows trap value is sent:

      • 0 – Email Connector status is DISABLED

      • 1 – Email Connector status is Enabled and Email Connector health is GOOD

      • 2 – Email Connector health is DEGRADED

      • 3 – Email Connector health is OVERLOADED

      Email Gateway Wait time

      Trap is sent with value 1 when the Wait Time for McAfee Email Gateway exceeds the configured threshold value set in Global Settings.

      Malware Interface Status

      The follows trap value is sent:

      • 0 – malware interface status is DOWN.

      • 1 – malware interface status is UP.

      License Status

      The follows trap value is sent from Virtual Intelligent Sandbox:

      • 1 – License is VALID

      • 2 – License is INVALID

      • 3 – License is EXPIRED

      Malware DNS Status

      The following trap value is sent:

      • 0 – Malware DNS status is DOWN.

      • 1 – Malware DNS status is UP.

      Point Products

      DXL Status

      The follows trap value is sent:

      • 0 – Last attempt to send TIE report failed.

      • 1 – Last attempt to send TIE report was successful.

      TAXII Status

      The follows trap value is sent:

      • 0 – Last attempt to send TAXII report failed.

      • 1 – Last attempt to send TAXII report was successful.

      • 2 – STIX report sent is not yet received.

      Sensor Status

      The follows trap value is sent for NSP Sensor status:

      • 0 – Sensor status is INACTIVE.

      • 1 – Sensor status is ACTIVE.

      • 2 – Sensor status is NOT CONNECTED.

  8. Click Submit.

What to do next

  • Ensure that you download the latest management information base (MIB) file using from MIB Download link on the SNMP Configuration page. Then upload the file to your SNMP MIB browser.

  • To retrieve the attribute numeric values, enter the snmpget command in the command prompt or any MIB browser.