CISCO-CIDS-MIB
AI MIB Summary
The CISCO-CIDS-MIB enables SNMP monitoring of Cisco Intrusion Detection System sensors by exposing health metrics such as memory critical states and defining trap notifications for IDIOM evAlert and evError events.
Cisco Intrusion Detection System MIB. Provides trap definitions for the evAlert and evError elements of the IDIOM (Intrusion Detection and Operations Messages) document and read support for the Intrusion Detection System (sensor) health information, such as if the sensor is in a memory critical stage.
Main OID:
ciscoCidsMIB.1.3.6.1.4.1.9.9.383
113
Objects
Active
Status
7
Dependencies
Imported Objects
Objects
113 total| Object Name |
|---|
ciscoCidsMIBCisco Intrusion Detection System MIB. Provides
trap definitions for the evAlert and evError
elements of the IDIOM (Intrusion Detection and
Operations Messages) document and read support
for the Intrusion Detection System (sensor)
health information, such as if the sensor is
in a memory critical stage. MODULE-IDENTITY .1.3.6.1.4.1.9.9.383 |
ciscoCidsMIBNotifs OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.0 |
ciscoCidsAlertEvent indicating that some suspicious or malicious
activity has been detected on a monitored network. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.383.0.1 |
ciscoCidsErrorEvent indicating that an error has occurred. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.383.0.2 |
ciscoCidsHealthHeartBeatThis notification is triggered by the heart beat events
(evStatus). The heartbeat is configured to run on a periodic
basis and can be enabled/disabled through heart beat
configuration under the health service. If the heart beat is
disabled these notification events will not be sent.
This notification is supposed to mirror the heart beat evStatus
message however it is a subset of the most critical pieces of
data. Namely this will include the following pieces of data:
- Event ID
- Host ID
- Local Time
- UTC Time
- Overall Application Color
- Sensor/Inspection Load Color
- Overall Health NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.383.0.3 |
ciscoCidsHealthMetricChangeThis notification notifies the recipient of health and
security status changes. This notification is triggered when
there is a change in the value of monitored metrics as indicated
by evStatus message. This notification will include the
following important subset of attributes from evStatus message:
- Event ID
- Host ID
- Local Time
- UTC Time
- Overall Application Color
- Sensor/Inspection Load Color
- Overall Health
This is similar to the heart beat, however the triggering
condition is different. The heart beat fires on a regular
interval and this is sent immediately after a change in a
monitored metric. Metric change notifications can be enabled
while the heart beat is disabled. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.383.0.4 |
ciscoCidsMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.1 |
cidsGeneral OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.1.1 |
cidsGeneralEventIdIdentifies the sequence number of an event.
This value needs to be unique within the scope
of the originating host.ro Unsigned64 (CISCO-TC) .1.3.6.1.4.1.9.9.383.1.1.1 |
cidsGeneralLocalTimeThe local time on the Cisco intrusion detection
system sensor when the alert was generated.ro DateAndTime (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.1.2 |
cidsGeneralUTCTimeThe UTC time on the Cisco intrusion detection
system sensor when the alert was generated.ro DateAndTime (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.1.3 |
cidsGeneralOriginatorHostIdA globally unique identifier for a Cids host. Could
be a host name or an IP address.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.1.4 |
cidsGeneralOriginatorAppNameThe optional generic name of a Cids application.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.1.5 |
cidsGeneralOriginatorAppIdThe optional id of this instance of the application.
Typically the process id (pid).ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.1.6 |
cidsNotificationsEnabledIndicates whether notifications will or will not
be sent when an event is generated by the device.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.1.7 |
cidsAlert OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.1.2 |
cidsAlertSeverityThe severity associated with a Cids signature
(informational, low, medium or high for
example).ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.1 |
cidsAlertAlarmTraitsThe alarm traits is an unsigned 16-bit integer
representing the value of the 16 user-defined
alarm traits specified in the configuration for
the signature that triggered the alert. The
alarmTraits bits are used to classify signatures
into user-defined categories or groups.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.2 |
cidsAlertSignatureContent is a string containing details about the
signature that fired, without any specifics tied
to this instance of the alert. The
cidsAlertSignatureSigName, cidsAlertSignatureSigId
and cidsAlertSignatureSubSigId attributes define
the signature that triggered this Alert.ro SnmpAdminString .1.3.6.1.4.1.9.9.383.1.2.3 |
cidsAlertSignatureSigNameThe name of the Intrusion detection signature
that triggered this event.ro SnmpAdminString .1.3.6.1.4.1.9.9.383.1.2.4 |
cidsAlertSignatureSigIdThe ID of the Intrusion detection signature
that triggered this event. The ID combines
with the cidsAlertSignatureSubSigId to
create a unique key that identifies the
signature that generated this event.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.5 |
cidsAlertSignatureSubSigIdThe optional Sub ID of the Intrusion detection
signature that triggered this event. The Sub
ID combines with the cidsAlertSignatureSigId
to create a unique key that identifies the
signature that generated this event.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.6 |
cidsAlertSignatureVersionThe optional version attribute defines the version
number of the signature update in which the triggering
signature was introduced or was last modified.
Example: 4.1(1.1)S47(0.1)ro SnmpAdminString .1.3.6.1.4.1.9.9.383.1.2.7 |
cidsAlertSummaryOptional, if present, specifies that this is a
summary alert, representing one or more alerts with
common characteristics. The numeric value indicates
the number of times the signature fired since the
last summary alert with a matching 'initialAlert'
attribute value. The first and all subsequent
summary alerts in a sequence will use the eventId
of a previous non-summary evAlert in the initialAlert
attribute value. All alerts represented by the
summary alert share the same signature and
sub-signature id. The summaryType attribute defines
the common characteristic(s) of all alerts in the
summary. The 'final' attribute indicates whether
this is the last evAlert containing the same value
in the 'initialAlert' attribute. The 'final'
attribute may be omitted if and only if its value
is false.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.8 |
cidsAlertSummaryTypeCommon characteristics shared by all non-summary
alerts included in a summary alert.ro SnmpAdminString .1.3.6.1.4.1.9.9.383.1.2.9 |
cidsAlertSummaryFinalThe optional 'final' attribute indicates whether
this is the last evAlert containing the same value
in the 'initialAlert' attribute. The 'final'
attribute may be omitted if and only if its value
is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.10 |
cidsAlertSummaryInitialAlertSerial number for the initial alert, which is
guaranteed unique within the scope of the
originating host.ro Unsigned64 (CISCO-TC) .1.3.6.1.4.1.9.9.383.1.2.11 |
cidsAlertInterfaceGroupThis object indicates an optional numeric identifier for a
sniffing
interface group on this host.rodeprecated Integer32 (-2147483648..2147483647) .1.3.6.1.4.1.9.9.383.1.2.12 |
cidsAlertVlanAn optional numeric identifier for a vlan. Identifies
the vlan that uses the number in ISL or 802.3.1q
headers.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.13 |
cidsAlertVictimContextOptional Base64-encoded representation of the stream
data that was sourced by the victim.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.14 |
cidsAlertAttackerContextOptional Base64-encoded representation of the stream
data that was sourced by the Attacker.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.15 |
cidsAlertAttackerAddressOptional IP address and ports on a monitored
interface. The 'locality' attribute is a string
that indicates the relative location of the IP
address within the network mapping, such as whether
the address falls within the address range of a
protected network. The optional 'proxy' attribute
is 'true' if the sensor has reason to suspect that
the address given is not the address of the true
attacker. This could be a the result of address
spoofing or because the host has been compromised
and is acting as a 'zombie'. The 'proxy' attribute
may be omitted if and only if its value is false.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.16 |
cidsAlertVictimAddressOptional IP address and ports on a monitored
interface. The 'locality' attribute is a string
that indicates the relative location of the IP
address within the network mapping, such as
whether the address falls within the address range
of a protected network. The 'osIdSource' attribute
represents the method that the operating system
of the victim was identified. The 'osType'
attribute represents the operating system of the
target system. The 'osRelevance' attribute
represents the relevance of an attack on the
operating system.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.17 |
cidsAlertIpLoggingActivatedIndicates whether IP logging has been activated as
the result of the alert. A separate evIpLogStatus
event will be generated when logging has been
completed. The evIpLogStatus event contains the
URL where the log results may be obtained. This
element may be omitted if and only if its value
is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.18 |
cidsAlertTcpResetSentIndicates whether a attempt was made to reset a tcp
connection as the result of the alert. The addresses
and ports affected must be implied from the
information contained in the participant elements of
the evAlert. This element may be omitted if and only
if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.19 |
cidsAlertShunRequestedIndicates whether an IP address or tcp connection
has been requested to be shunned as a result of the
alert. Details about the addresses and ports
involved in the shun can be obtained from evNacStatus
events sent by the Network Access Controller
application. This element may be omitted if and only
if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.20 |
cidsAlertDetailsTextual details about the specific alert instance,
not just the signature.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.21 |
cidsAlertIpLogIdIP log identifiers for IP logs that were added as
the result of this alert.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.22 |
cidsThreatResponseStatusA brief textual description of the status of
the alarm given by the Cisco Systems Threat
Response engine.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.2.23 |
cidsThreatResponseSeverityThe alarm severity as assigned by the Cisco Systems
Threat Response engine.ro Integer32 (-2147483648..2147483647) .1.3.6.1.4.1.9.9.383.1.2.24 |
cidsAlertEventRiskRatingA risk factor that incorporates several additional
pieces of information beyond the detection of a
potentially malicious action. The factors that
characterize this risk are the severity of the
attack if it were to succeed, the fidelity of the
signature, the relevance of the potential attack
with respect to the target host, and the overall
value of the target host to the customer.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.25 |
cidsAlertIfIndexThe ifIndex on which the activity was detected.ro InterfaceIndex (IF-MIB) .1.3.6.1.4.1.9.9.383.1.2.26 |
cidsAlertProtocolIdentifies the IP protocol associated with the
alert.ro CiscoIpProtocol (CISCO-TC) .1.3.6.1.4.1.9.9.383.1.2.27 |
cidsAlertDeniedAttackerIndicates that the traffic from originating from
the attacker is being blocked as a result of the
alert. This element may be omitted if and only if
its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.28 |
cidsAlertDeniedFlowIndicates that the traffic on the TCP connection
being blocked as a result of the alert. This
element may be omitted if and only if its value
is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.29 |
cidsAlertDenyPacketReqNotPerfIndicates whether the packet that triggered the
alert would have been denied as a result of the
alert if the intrusion prevention system was
operating in inline mode. However, the packet
was not actually denied because the intrusion
prevention system was operating in promiscuous
mode. This element may be omitted if and only
if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.30 |
cidsAlertDenyFlowReqNotPerfIndicates whether the flow that triggered the
alert would have been denied as a result of the
alert if the intrusion prevention system was
operating in inline mode. However, this action
was not actually taken because the intrusion
prevention system was operating in promiscuous
mode. This element may be omitted if and only
if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.31 |
cidsAlertDenyAttackerReqNotPerfIndicates whether the traffic from the attacker
that triggered the alert would have been denied as
a result of the alert if the intrusion prevention
system was operating in inline mode. However, this
action was not actually taken because the intrusion
prevention system was operating in promiscuous
mode. This element may be omitted if and only if
its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.32 |
cidsAlertBlockConnectionReqIndicates that a TCP connection has been requested
to be blocked as a result of the alert. This element
may be omitted if and only if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.33 |
cidsAlertLogAttackerPacketsActIndicates that packets associated with the
attacker(s) identified by this alert are being
logged. This element may be omitted if and
only if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.34 |
cidsAlertLogVictimPacketsActIndicates that packets associated with the victim(s)
identified by this alert are being logged. This
element may be omitted if and only if its value is
false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.35 |
cidsAlertLogPairPacketsActivatedIndicates that packets associated with the
attacker/victim pair(s) identified by this alert
are being logged. This element may be omitted if
and only if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.36 |
cidsAlertRateLimitRequestedIndicates that traffic rate limiting based on the
source address and protocol associated with the alert
has been requested on external network devices. This
element may be omitted if and only if its value is
false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.37 |
cidsAlertDeniedAttackVictimPairIndicates that traffic from originating from the
attackers address and destined for the victims address
identified in the alert is being denied as a result of
the alert. This element may be omitted if and only if
its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.38 |
cidsAlertDeniedAttackSericePairIndicates that traffic from originating from the
attackers address and destined for the destination
service port identified in the alert is being denied
as a result of the alert. This element may be omitted
if and only if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.39 |
cidsAlertDenyAttackVicReqNotPerfIndicates that traffic from originating from the
attackers address and destined for the victims address
identified in the alert would have been denied as a
result of the alert if the intrusion prevention system
was operating in inline mode. However, this action was
not actually taken because the intrusion prevention
system was operating in promiscuous mode. This
element may be omitted if and only if its value is
false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.40 |
cidsAlertDenyAttackSerReqNotPerfIndicates that traffic from originating from the
attackers address and destined for the destination
service port identified in the alert would have been
denied as a result of the alert if the intrusion
prevention system was operating in inline mode.
However, this action was not actually taken because
the intrusion prevention system was operating in
promiscuous mode. This element may be omitted if
and only if its value is false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.41 |
cidsAlertThreatValueRatingValue that represents the calculated threat
associated with the detected activity. The threat
value consists of the cidsAlertEventRiskRating
adjusted for the mitigation action performed.
The threat value has a range between 0 and 100
(inclusive), where a value of 0 represents the
lowest threat and 100 the greatest threat.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.42 |
cidsAlertRiskRatingTargetValueRepresents the asset value associated with
a target identified in the alert.ro CidsTargetValue .1.3.6.1.4.1.9.9.383.1.2.43 |
cidsAlertRiskRatingRelevanceValue that represents an attack's relevance to
the destination target of this alert.ro CidsAttackRelevance .1.3.6.1.4.1.9.9.383.1.2.44 |
cidsAlertRiskRatingWatchListValue that represents the amount that the risk
rating value was increased due to the source
of the activity associated with the alert being
on a watchlist.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.2.45 |
cidsAlertDenyPacketThis object indicates that the traffic originating from
the attacker is being blocked as a result of the
alert. This element may be omitted if and only if
its value is 'false'.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.46 |
cidsAlertBlockHostThis object indicates that a host has been requested
to be blocked as a result of the alert. This element
may be omitted if and only if its value is 'false'.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.47 |
cidsAlertTcpOneWayResetSentThis object indicates an attempt to reset one side of the
connection (the victim side). The victim address and ports
affected must be implied from the information contained in the
participant elements of the alert. This element may be omitted
if and only if its value is 'false'.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.2.48 |
cidsAlertVirtualSensorThis object represents the name of the virtual sensor
associated with an Intrusion Prevention System alert. From the
virtual sensor name one can correlate which signature set and
configuration to look at to trouble shoot or tune the behavior
of the sensor. The virtual sensor name with the signature ID
should help in identifying the correct instance of the signature
that fired the alert.ro SnmpAdminString .1.3.6.1.4.1.9.9.383.1.2.49 |
cidsError OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.1.3 |
cidsErrorSeveritySeverity of an error (warning, error or fatal
for example). An example of a type of error
that could occur would be when a requested
action could not be completed because it
would create a resource that would exceed a
system resource limit.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.3.1 |
cidsErrorNameAn enumerated error code, which identifies a general
class of errors.ro CidsErrorCode .1.3.6.1.4.1.9.9.383.1.3.2 |
cidsErrorMessageA textual description of the error that occurred.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.3.3 |
cidsHealth OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.1.4 |
cidsHealthPacketLossThe percentage of packets lost at the device
interface level.ro Integer32 .1.3.6.1.4.1.9.9.383.1.4.1 |
cidsHealthPacketDenialRateThe percentage of packets denied due to
protocol and security violations.ro Integer32 .1.3.6.1.4.1.9.9.383.1.4.2 |
cidsHealthAlarmsGeneratedThe number of alarms generated, includes
all currently defined alarm severities.ro Counter32 .1.3.6.1.4.1.9.9.383.1.4.3 |
cidsHealthFragmentsInFRUThe number of fragments currently queued in the
fragment reassembly unit.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.4 |
cidsHealthDatagramsInFRUThe number of datagrams currently queued in the
fragment reassembly unit.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.5 |
cidsHealthTcpEmbryonicStreamsThe number of embryonic TCP streams currently
queued in the device. TCP streams are
considered embryonic if they have not
completed the TCP three-way handshake.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.6 |
cidsHealthTCPEstablishedStreamsThe number of established TCP streams currently
queued in the device. Once a stream has
completed a TCP three-way handshake it will
move to the established state.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.7 |
cidsHealthTcpClosingStreamsThe number of closing TCP streams currently
queued in the device. A stream will move
from the established state to closing when
a valid FIN or RST flag is received.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.8 |
cidsHealthTcpStreamsThe number of TCP streams (embryonic,
established and closing) currently queued
in the device.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.9 |
cidsHealthActiveNodesThe number of active nodes currently queued in
the device.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.10 |
cidsHealthTcpDualIpAndPortsThe number TCP nodes keyed on both IP addresses
and both ports currently queued in the device.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.11 |
cidsHealthUdpDualIpAndPortsThe number UDP nodes keyed on both IP addresses
and both ports currently queued in the device.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.12 |
cidsHealthIpDualIpThe number IP nodes keyed on both IP addresses
currently queued in the device.ro Gauge32 .1.3.6.1.4.1.9.9.383.1.4.13 |
cidsHealthIsSensorMemoryCriticalA value between 0 and 10 that should rarely
get above 3. If this is non-zero the sensor
has stopped enforcing policy on some traffic in
order to keep up with the current traffic load;
the sensor is oversubscribed. The higher the
number the more oversubscribed the sensor. It
could be oversubscribed from a memory prospective
and not traffic speed. For example on a 200 Mbit
sensor this number might be 3 if the sensor was
only seeing 100Mbit of traffic but 6000
connections per second which is over the rated
capacity of the sensor. When the sensor is
in Memory Critical state then a ciscoCidsError
trap will be sent accordingly.ro Unsigned32 .1.3.6.1.4.1.9.9.383.1.4.14 |
cidsHealthIsSensorActiveIndicates the failover status of the device.
True indicates the device is currently active.
False indicates it is in a standby mode.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.4.15 |
cidsHealthCommandAndControlPortThe status and network statistics of the
currently configured Command and Control
interface on the device. The Command
and Control interface is where all of the
communications for command and control
of the sensor occurs. This is important
to identify what interface a user will
communicate with to control the sensor
remotely and general health statistics
for that interface.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.383.1.4.16 |
cidsHealthSensorStatsResetTimeThe value of SNMPv2-MIB::sysUpTime
when the Sensor specific statistics
was reset. The reset time is
collectively for the following objects:
cidsHealthPacketLoss,
cidsHealthPacketDenies,
cidsHealthAlarmsGenerated,
cidsHealthFragmentsInFRU,
cidsHealthDatagramsInFRU,
cidsHealthTcpEmbryonicStreams,
cidsHealthTcpEstablishedStreams,
cidsHealthTcpClosingStreams,
cidsHealthTcpStreamsro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.9.9.383.1.4.17 |
cidsHealthSecMonAvailabilityThis object indicates the availability of health and security
monitor statistics. If the IPS health and security monitoring
service is disabled, it will return false.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.4.18 |
cidsHealthSecMonOverallHealthThis object indicates IPS sensor's overall health value -
green, yellow or red. The overall health status is set to the
highest severity of all metrics that are configured to be
applied to the IPS's health determination. For example, if the
IPS is configured to use eight metrics to determine its health
and seven of eight metrics are green while one of the metrics
is
red then the overall IPS health will be red.
This object is instantiated only if the value of cidsHealthSecMonAvailability is set to 'true'.ro CidsHealthStatusColor .1.3.6.1.4.1.9.9.383.1.4.19 |
cidsHealthSecMonSoftwareVersionThis object indicates the IPS software version number (e.g.,
6.2(1)E3).
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro DisplayString .1.3.6.1.4.1.9.9.383.1.4.20 |
cidsHealthSecMonSignatureVersionThis object indicates IPS signature version (e.g., 365.0).
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro DisplayString .1.3.6.1.4.1.9.9.383.1.4.21 |
cidsHealthSecMonLicenseStatusThis object indicates IPS license status along with expiration
date. For example it will contain the following possible
values:
- signatureUpdateKey: Not expired until: <timestamp>
- trialKey: Not expired until: <timestamp>
- expiredLicense
- noLicense
- invalidLicense
- unknown
The timestamp will be in the format:
MM/DD/YYYY HH:MM:SS
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro DisplayString .1.3.6.1.4.1.9.9.383.1.4.22 |
cidsHealthSecMonOverallAppColorThis object indicates the aggregate health status of the
applications - Main, Analysis Engine, Collaboration - where the
status is equal to the most severe status of all three
applications.
It is used in both the heart beat and the metric change health
traps.ro CidsHealthStatusColor .1.3.6.1.4.1.9.9.383.1.4.23 |
cidsHealthSecMonMainAppStatusThis object indicates the running status for the control plane.
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro CidsApplicationStatus .1.3.6.1.4.1.9.9.383.1.4.24 |
cidsHealthSecMonAnalysisEngineStatusThis object indicates the running status for the Analysis
Engine.
This object is instantiated only if the value of cidsHealthSecMonAvailability is set to 'true'.ro CidsApplicationStatus .1.3.6.1.4.1.9.9.383.1.4.25 |
cidsHealthSecMonCollaborationAppStatusThis object indicates the running status for the Collaboration
Application.
This object is instantiated only if the value of cidsHealthSecMonAvailability is set to 'true'.ro CidsApplicationStatus .1.3.6.1.4.1.9.9.383.1.4.26 |
cidsHealthSecMonByPassModeThis object indicates the bypass mode. A value of 'true'
indicates bypass mode is on and a value of 'false' indicates it is off.
This object is instantiated only if the value of cidsHealthSecMonAvailability is set to 'true'.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.383.1.4.27 |
cidsHealthSecMonMissedPktPctAndThreshThis object indicates the missed packet percentage and missed
packets percentage threshold aggregated for all interfaces.
For example, 'missedPacketPercentage=1 redThreshold=6
yellowThreshold=1'.
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro DisplayString .1.3.6.1.4.1.9.9.383.1.4.28 |
cidsHealthSecMonAnalysisEngMemPercentThis object indicates the percentage of memory used by Analysis
Engine.
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro Integer32 .1.3.6.1.4.1.9.9.383.1.4.29 |
cidsHealthSecMonSensorLoadThis object indicates sensor inspection load.
This object is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'.ro Integer32 .1.3.6.1.4.1.9.9.383.1.4.30 |
cidsHealthSecMonSensorLoadColorThis object indicates the status of current sensor load,
indicated
using status colors. The color is determined based on the
sensor load percentage and configured threshold value.ro CidsHealthStatusColor .1.3.6.1.4.1.9.9.383.1.4.31 |
cidsHealthSecMonVirtSensorStatusTableThis table contains the status of each virtual sensor. There
will be one entry per virtual sensor in the system. This is the
status of the network that the virtual sensor is monitoring. A
virtual sensor can be added either through the configuration CLI
or through a management application such as IME/CSM; once it is
added to the system it will appear in this table. If a virtual
sensor is removed from the system through one of the management
interfaces it will no longer appear in this table.
This table is instantiated only if the value of cidsHealthSecMonAvailability is set to 'true'. SEQUENCE OF CidsHealthSecMonVirtSensorStatusEntry .1.3.6.1.4.1.9.9.383.1.4.32 |
cidsHealthSecMonVirtSensorStatusEntryAn entry (conceptual row) in the
cidsHealthSecMonVirtSensorStatusTable. There will be one per
virtual sensor on the system.
A virtual sensor allows one to logically separate their sensor
configuration for different sets of interfaces. For example
virtual sensor vs0 may apply to one set of interfaces and vs1
would apply to another set of interfaces. This table allows
someone to get the status of each of the virtual sensors to
determine the health of the associated networks.
For example you could have vs0 monitoring your finance networks
and vs1 monitoring your engineering networks and track the
health of each of these networks independently. CidsHealthSecMonVirtSensorStatusEntry .1.3.6.1.4.1.9.9.383.1.4.32.1 |
cidsHealthSecMonVirtSensorNameThis object represents the name of the virtual sensor. Through
the IPS configuration the sensor name can be correlated with
the
sensor configuration and the associated interfaces to identify
which networks are having good or bad health status. The reason
there are multiple virtual sensor configurations is to allow
different configurations for different sets of network
interfaces. DisplayString .1.3.6.1.4.1.9.9.383.1.4.32.1.1 |
cidsHealthSecMonVirtSensorStatusThis object represents the virtual sensor network status level.
From the color rating associated with the virtual sensor you
can
determine the overall health of the attached networks. If the
color is green everything is fine, the IPS is not indicating a
problem. If the color is yellow you should check as there
maybe
issues occuring on the attached network. If the status is red
the network needs attention as problems are detected and network
security is critical.ro CidsHealthStatusColor .1.3.6.1.4.1.9.9.383.1.4.32.1.2 |
cidsHealthSecMonDataStorageTableThis is the table of disk partition details:
Partition Name
Total Space In Partition
Utilized Space
This table tells how each of the file systems are utilized on
the IPS. If the file systems approach 100% utilization that
may indicate a problem. This table should remain fixed
size unless an upgrade/install changes the partition count.
The user does not have control over the number of partitions
or the ability to add and remove partitions.
This table is instantiated only if the value of
cidsHealthSecMonAvailability is set to 'true'. SEQUENCE OF CidsHealthSecMonDataStorageEntry .1.3.6.1.4.1.9.9.383.1.4.33 |
cidsHealthSecMonDataStorageEntryAn entry (conceptual row) in the
cidsHealthSecMonDataStorageTable.
There will be one row per partition.
This table is here to track the health of the storage on the
IPS sensor. The following partitions will have their status
displayed as part of the data storage table:
system
This is the root file system on the sensor; this file system
should not change too much over time and should not be full.
application-data
This is the main file system where application binaries,
application logs and configuration data is stored. This file
system will change due to logging and configuration changes; if
this file system is full it will present stability problems.
This partition is the most important in the system to monitor.
boot
Kernel/boot data storage partition; this should not change
much other than during an image upgrade.
application-log
This partition has fixed sized files to store IPLOG data.
This will likely run near full capacity without being a
problem.
The most important partition to monitor over time is the
application-data partition; if it runs to capacity problems
will occur as processes will no longer be able to write data to
the file system.
Note: File system setup and utilization will vary per platform
model; there are no perfect rules for monitoring these across
all platforms however you should be able to use trends over
time to indicate if you are going to fill up a file system that
should not run at capacity such as the application-data
partition. CidsHealthSecMonDataStorageEntry .1.3.6.1.4.1.9.9.383.1.4.33.1 |
cidsHealthSecMonPartitionNameName of the disk partition. For example:
system
application-data
boot
application-log DisplayString .1.3.6.1.4.1.9.9.383.1.4.33.1.1 |
cidsHealthSecMonTotalPartitionSpaceThis object represents the total disk space on the partition in
megabytes.ro Unsigned32 UNITS "MB" .1.3.6.1.4.1.9.9.383.1.4.33.1.2 |
cidsHealthSecMonUtilizedPartitionSpaceThis object represents the total amount of utilized disk space
in megabytes.ro Unsigned32 UNITS "MB" .1.3.6.1.4.1.9.9.383.1.4.33.1.3 |
ciscoCidsMIBConform OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.2 |
ciscoCidsMIBCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.2.1 |
ciscoCidsMIBGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.383.2.2 |