Trap SNMP for threat

[brunoetienne91]

Hi all,

From the mib file named PAN-TRAPS.mib I can see that there are some information about threat objects.

Is there anybody who knows how to use this.

I have tried to generate some threats but no traps were sent to the manager.

Thanks

Bruno

[jdelio]

Bruno,
Please confirm the following:

Have you configured the Log forwarding settings in Objects tab? If not, you will have to create an entry to have SNMP traps occurs properly.

Click +Add to create a Log Forwarding Profile.

In this section, there are 2 sections to be forwarded: Traffic Settings and Threat Settings.

Each security policy can specify a log forwarding profile that determines whether traffic and threat log entries are logged remotely with Panorama, and/or sent as SNMP traps, syslog messages, or email notifications. By default, only local logging is performed.

Traffic logs record information about each traffic flow, and threat logs record the threats or problems with the network traffic, such as virus or spyware detection. Note that the antivirus, anti-spyware, and vulnerability protection profiles associated with each rule determine which threats are logged (locally or remotely).

Under threats, you will notice the Severity levels.  You have to configure SNMP(ver 2 or 3) with a SNMP Trap, Email and or Syslog destination. And every option has detailed settings.Please see below information about the Thread log settings.

Threat Log Settings

The severity levels are:

• Critical—Very serious attacks detected by the threat security engine.

• High—Major attacks detected by the threat security engine.

• Medium—Minor attacks detected by the threat security engine, including URL blocking.

• Low—Warning-level attacks detected by the threat security engine.

• Informational—All other events not covered by the other severity levels, including informational attack object matches.

I hope this helps answer your question.

[bable]

Hi,

I do have the same problem. After a snmpwalk, I receive about 380 OID's. But the OID's which are provided by Palo Alto, refering to PAN-TRAPS are not available and not shown through snmpwalk.

How can I get the threat, virus, or any other snmp related trap.?