SNMP notifications - some missing?

[mcocat]

I have enabled SNMP notifications on threats greater than or equal to severity "medium". Under monitor > threats I am seeing my alerts, but I only receive (via SNMP) some of the threats that shows up on the PA interface. Here is an example:

I am only receiving SNMP alarms on the "SCAN: Host Sweeps", but not the spyware or the virus.

Is this because of the rule being hit? How can I enable notifications on all of the rules?

[ssharma]

Hi @mcocat,

You can configure SNMP under Objects -> Log Forwarding.

Then use this log forwarding on all security policy that you want get alerts from. Under Policies - > Security -> Action -> Log Forwarding

Hope this helps. Thank you.

[mcocat]

So for my P_User Rule -Apps Allowed rule, I already have log forwarding enabled.

And here is my log forwarding settings:

[ssharma · Accepted solution]

Yes, you are using P-Panorama log forwarding profile, which does not have SNMP enabled on them. You have Panorama rule, which has SNMP but that is not used in your P_User Rule -Apps Allowed rule.

So 2 options,

1. either use Panorama log forwarding instead of P-Panorama in P_User Rule -Apps Allowed rule

2. Or modify P-Panorama rule to include snmp on them

Hope this helps. Thank you.

[mcocat]

That makes sense, I have a commit running now. So the fact that I was receiving alerts for the entries that didn't match a rule would mean that my default isn't configured correctly to use P-Panorama. Where can I change the default? Thanks for your help!

[ssharma]

You have to change P-Panorama from the Panorama server, which is pushing these configuration. Hope this helps. Thank you.