topic Re: It is necessary to select certain SNMP traps when working internal_snmp_trap in Firewall and Security Management

It is necessary to select certain SNMP traps when working internal_snmp_trap

eivanov — Mon, 11 Dec 2023 14:00:55 GMT

Hi all!
There is a need to selectively send internal_snmp_trap IPS events with only critical importance (severity Hight and critical) and awareness level High (confidence)

Currently Checkpoint sends all events to Zabbix Server

Thank you!

Re: It is necessary to select certain SNMP traps when working internal_snmp_trap

PhoneBoy — Thu, 14 Dec 2023 20:48:27 GMT

To be selective about what you send to Zabbix, you'll probably need to write a script to send only events you care about.
This script will need to exist on the management server.

Re: It is necessary to select certain SNMP traps when working internal_snmp_trap

eivanov — Fri, 15 Dec 2023 12:12:00 GMT

Thank you very much for your answer. Is there an example of creating such a script or

a document describing how to do this?

Re: It is necessary to select certain SNMP traps when working internal_snmp_trap

PhoneBoy — Fri, 15 Dec 2023 19:01:42 GMT

The start of your script will be something like:

#!/bin/bash event=`</dev/stdin`

You will have to parse the event variable based on your specific requirements and send the appropriate SNMP trap using the CLI command fwm snmp_trap.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CLI_ReferenceGuide/Content/Topics-CLIG/MDSG/fwm-snmp_trap.htm

Re: It is necessary to select certain SNMP traps when working internal_snmp_trap

Daniel_Kavan — Fri, 17 Apr 2026 12:28:22 GMT

How does just adding the IP address work? What about the community (public) or version?

Shouldn't the line read like ths for example?

internal_snmp_trap $IPADDRESS -v2 -c public