Sandblast Threat Emulation SNMP

morris — Fri, 23 Oct 2020 09:11:47 GMT

Hi there,

we want to check the Pending emulating requests (Output of tecli show emu emu) with SNMP

I've compared the output of two snmp walks (one while no Pending emulating requests and one with more than 30 Pending emulating requests). But the outpot of both walks was the same.

https://community.checkpoint.com/t5/SandBlast-Network/Using-SNMP-with-SandBlast-Network/td-p/40637

tecli show emu emu

Pending emulating requests: 31
Running virtual machines: 4
Number of emulated files: 24

Has anyone any idea how to check that value or has another idea what OID could be checked get similar information?

Best regards,
Morris

Re: Sandblast Threat Emulation SNMP

Forsaken_61 — Wed, 29 Nov 2023 12:15:13 GMT

I'm having the same question. Did you managed to fix this?

Re: Sandblast Threat Emulation SNMP

morris — Tue, 19 Dec 2023 12:06:38 GMT

Basically if I snmpwalk I get these results:

[Expert@cpsandblast:0]# snmpwalk -v 2c -c xxx localhost .1.3.6.1.4.1.2620.1.49
SNMPv2-SMI::enterprises.2620.1.49.3.0 = STRING: "100%"
SNMPv2-SMI::enterprises.2620.1.49.4.1.0 = Gauge32: 20708
SNMPv2-SMI::enterprises.2620.1.49.4.2.0 = Gauge32: 356
SNMPv2-SMI::enterprises.2620.1.49.4.3.0 = Gauge32: 2767
SNMPv2-SMI::enterprises.2620.1.49.4.4.0 = Gauge32: 13446
SNMPv2-SMI::enterprises.2620.1.49.5.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.5.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.5.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.5.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.6.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.7.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.8.1.0 = Gauge32: 79
SNMPv2-SMI::enterprises.2620.1.49.8.2.0 = Gauge32: 113
SNMPv2-SMI::enterprises.2620.1.49.8.3.0 = Gauge32: 66
SNMPv2-SMI::enterprises.2620.1.49.8.4.0 = Gauge32: 69
SNMPv2-SMI::enterprises.2620.1.49.9.1.0 = Gauge32: 124126
SNMPv2-SMI::enterprises.2620.1.49.9.2.0 = Gauge32: 385518
SNMPv2-SMI::enterprises.2620.1.49.9.3.0 = Gauge32: 388842
SNMPv2-SMI::enterprises.2620.1.49.9.4.0 = Gauge32: 457460
SNMPv2-SMI::enterprises.2620.1.49.10.1.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.10.2.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.10.3.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.10.4.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.11.1.0 = Gauge32: 102
SNMPv2-SMI::enterprises.2620.1.49.11.2.0 = Gauge32: 20
SNMPv2-SMI::enterprises.2620.1.49.11.3.0 = Gauge32: 23
SNMPv2-SMI::enterprises.2620.1.49.11.4.0 = Gauge32: 21
SNMPv2-SMI::enterprises.2620.1.49.12.0 = Gauge32: 2
SNMPv2-SMI::enterprises.2620.1.49.13.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.14.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.15.0 = Gauge32: 5
SNMPv2-SMI::enterprises.2620.1.49.16.0 = STRING: "up-to-date"
SNMPv2-SMI::enterprises.2620.1.49.17.0 = STRING: "Gateway is up to date."
SNMPv2-SMI::enterprises.2620.1.49.19.0 = STRING: "temu_local"
SNMPv2-SMI::enterprises.2620.1.49.20.0 = STRING: "1735559812"
SNMPv2-SMI::enterprises.2620.1.49.21.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.22.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.23.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.24.0 = Gauge32: 4
SNMPv2-SMI::enterprises.2620.1.49.25.0 = STRING: "valid"
SNMPv2-SMI::enterprises.2620.1.49.26.0 = STRING: "ok"
SNMPv2-SMI::enterprises.2620.1.49.27.0 = STRING: "Subscription is up to date"
SNMPv2-SMI::enterprises.2620.1.49.28.0 = STRING: "Cloud emulation is not used"
SNMPv2-SMI::enterprises.2620.1.49.29.0 = Gauge32: 60
SNMPv2-SMI::enterprises.2620.1.49.30.0 = Gauge32: 990000400
SNMPv2-SMI::enterprises.2620.1.49.31.0 = STRING: "N/A"
SNMPv2-SMI::enterprises.2620.1.49.32.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.33.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.34.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.35.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.36.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.37.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.38.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.39.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.40.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.41.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.101.0 = Gauge32: 0
SNMPv2-SMI::enterprises.2620.1.49.102.0 = STRING: "ok"
SNMPv2-SMI::enterprises.2620.1.49.103.0 = ""

In chkpnt.mib I only see a handful of values

Is there anywhere a extended documentation?

Re: Sandblast Threat Emulation SNMP

PhoneBoy — Wed, 20 Dec 2023 00:54:04 GMT

What I'm saying is that this is not something that can be polled via SNMP by default.
You can extend the MIB to support your requirement: https://support.checkpoint.com/results/sk/sk90860

topic Sandblast Threat Emulation SNMP in Firewall and Security Management

Sandblast Threat Emulation SNMP

Re: Sandblast Threat Emulation SNMP

Re: Sandblast Threat Emulation SNMP

Re: Sandblast Threat Emulation SNMP

Re: Sandblast Threat Emulation SNMP