How to track IPS (Threat Prevention) by SNMP trap

[Louis_Poulin]

Running R80.10, how do you "track" IPS rules hit by SNMP trap to get useful (or custom) information?

For example, I would like the following information in the trap when the IPS prevent or detect something :

Severity

Confidence Level

Attack Name

Attack Information

Performance Impact

Protection Name

Protection Type

Action

But by default, there is no real valuable information in the trap in my own humble opinion.

[PhoneBoy]

If you look at your logs via the CLI (e.g. fw log -n | grep IPS), you'll see what can be sent.

You may just want to verify you get the same information by capturing it with a script using a User Defined alert.

These are set in Global Properties.

You can write a script to parse the information as required and use the snmp_trap command to send it.

[Louis_Poulin]

Hello Dameon,

I'm not familiar with scripts. Could you share some info/doc/website to get started please?

Thanks!

[PhoneBoy]

The kind of scripting in question is for bash or cshell (depending on your preference.

As these are standard Unix shells that have been around for many years, there are numerous sources of information for this.

[Louis_Poulin]

I just came to same deduction. I was about to edit my post Thank you, I'll be able to get something done with this.

[Louis_Poulin]

After playing around with the "fw log" command, I discovered recently that the alert received (either by mail or by SNMP trap) for Threat Prevention Policy rules is incomplete. We are only receiving about half the log information.

And guess what? The usefull information is mostly in the other half...

A service request is open in order to know how to get the full log information by alert and we are awaiting for the resolution.

In the meantime, if anyone has a solution, it would be appreciated!

[Louis_Poulin · Accepted solution]

It seems like the issue we are facing is related to sk123240 - Email alerts are truncated and missing fields :
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...