It is necessary to select certain SNMP traps when working internal_snmp_trap

[eivanov]

Hi all!
There is a need to selectively send internal_snmp_trap IPS events with only critical importance (severity Hight and critical) and awareness level High (confidence)

Currently Checkpoint sends all events to Zabbix Server

Thank you!

[PhoneBoy · Accepted solution]

To be selective about what you send to Zabbix, you'll probably need to write a script to send only events you care about.
This script will need to exist on the management server.

[eivanov]

Thank you very much for your answer. Is there an example of creating such a script or

a document describing how to do this? 

[PhoneBoy]

The start of your script will be something like:

#!/bin/bash
event=`</dev/stdin`

You will have to parse the event variable based on your specific requirements and send the appropriate SNMP trap using the CLI command fwm snmp_trap.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CLI_ReferenceGuide/Content/T...