Stormshield

Stormshield

Stormshield is a European cybersecurity company, a subsidiary of Airbus, that provides digital security solutions to protect networks, workstations, servers, and sensitive data for businesses, governments, and critical infrastructure, offering products for network security, endpoint protection, data security, and industrial environments.

Available solutions




This template is for Zabbix version: 7.4
Also available for: 7.0

Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/net/stormshield_sns?at=release/7.4

Stormshield SNS by SNMP

Overview

This template is designed for the effortless deployment of Stormshield SNS monitoring by Zabbix via SNMP and doesn't require any external scripts.

Requirements

Zabbix version: 7.4 and higher.

Tested versions

This template has been tested on:

  • Stormshield SNS v5.0

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

Refer to the vendor documentation.

Macros used

Name Description Default
{$SNS.CPU.UTIL.CRIT}

Threshold of CPU utilization for Critical trigger in %.

 95
{$SNS.CPU.UTIL.WARN}

Threshold of CPU utilization for Warning trigger in %.

 85
{$SNS.DISK.FREE.CRIT}

Threshold of free disk space for Critical trigger in %.

 10
{$SNS.DISK.FREE.WARN}

Threshold of free disk space for Warning trigger in %.

 20
{$SNS.ICMP.LOSS.WARN}

Threshold of ICMP packet loss for Warning trigger in %.

 20
{$SNS.ICMP.RESPONSE.TIME.WARN}

Threshold of average ICMP response time for Warning trigger in seconds.

 0.15
{$SNS.MEMORY.UTIL.MAX}

Threshold for memory utilization trigger in %.

 90
{$SNS.NET.IF.IFNAME.MATCHES}

Sets regex string of network interface names to allow in discovery.

 .*
{$SNS.NET.IF.IFNAME.NOT_MATCHES}

Sets regex string of network interface names to ignore in discovery.

 ^(sslvpn|ipsec)
{$SNS.STORAGE.TYPE.MATCHES}

Sets regex string of storage types to allow in discovery.

 .1.3.6.1.2.1.25.2.1.4
{$SNS.STORAGE.TYPE.NOT_MATCHES}

Sets regex string of storage types to ignore in discovery.

 CHANGE_IF_NEEDED
{$SNS.STORAGE.DESCR.MATCHES}

Sets regex string of storage descriptions to allow in discovery.

 ^(/data|/log)$
{$SNS.STORAGE.DESCR.NOT_MATCHES}

Sets regex string of storage descriptions to ignore in discovery.

 CHANGE_IF_NEEDED
{$SNS.SNMP.TIMEOUT}

Time interval for SNMP availability trigger.

 5m
{$SNS.SNMP.INTERVAL}

Time interval for SNMP agent items.

 1m

Items

Name Description Type Key and additional info
SNMP walk HA members

Used for discovering HA members from the Stormshield MIB.

 SNMP agent sns.ha.members.walk
SNMP walk health

Used for discovering health status from the Stormshield MIB.

 SNMP agent sns.health.walk
SNMP walk autoupdate

Used for discovering updates from the Stormshield MIB.

 SNMP agent sns.update.auto.walk
SNMP walk CPU temperature

Used for discovering CPU temperature from the Stormshield MIB.

 SNMP agent sns.cpu.temp.walk
SNMP walk CPU usage

Used for discovering CPU usage from the HOST-RESOURCES-MIB.

 SNMP agent sns.cpu.usage.walk
SNMP walk network interfaces

Used for discovering network interfaces from the Stormshield MIB.

 SNMP agent sns.net.if.walk
SNMP walk disk

Used for discovering disks from the Stormshield MIB.

 SNMP agent sns.disk.walk
SNMP walk fan

Used for discovering fans from the Stormshield MIB.

 SNMP agent sns.fan.walk
SNMP walk power supply

Used for discovering the power supply from the Stormshield MIB.

 SNMP agent sns.psu.walk
SNMP walk storage

Used for discovering storage from the HOST-RESOURCES-MIB.

 SNMP agent sns.storage.walk
SNMP walk memory

Used for discovering system memory utilization from the STORMSHIELD-SYSTEM-MONITOR-MIB.

 SNMP agent sns.memory.util.walk
ASQ TCP connection count

MIB: STORMSHIELD-ASQ-STATS-MIB

ASQ stateful TCP connection count.

 SNMP agent asq.alarm.stateful.tcp[snsASQStatsStatefulTcpConn.0]
ASQ UDP connection count

MIB: STORMSHIELD-ASQ-STATS-MIB

ASQ stateful UDP connection count.

 SNMP agent asq.alarm.stateful.udp[snsASQStatsStatefulUdpConn.0]
ASQ major alarm count

MIB: STORMSHIELD-ASQ-STATS-MIB

ASQ major alarm count.

 SNMP agent asq.alarm.stateful[snsASQStatsStatefulMajorAlarm.0]
ASQ minor alarm count

MIB: STORMSHIELD-ASQ-STATS-MIB

ASQ minor alarm count.

 SNMP agent asq.alarm.stateful[snsASQStatsStatefulMinorAlarm.0]
HA: Faulty HA links

MIB: STORMSHIELD-HA-MIB

Number of faulty HA links.

 SNMP agent ha.links.faulty[snsNbFaultyHALinks.0]
HA: Active firewalls

MIB: STORMSHIELD-HA-MIB

Number of active firewalls.

 SNMP agent ha.node.active[snsNbActiveNode.0]
HA: Firewalls in the cluster

MIB: STORMSHIELD-HA-MIB

Number of firewalls in the HA cluster.

 SNMP agent ha.node.count[snsNbNode.0]
HA: Firewalls not replying

MIB: STORMSHIELD-HA-MIB

Number of firewalls registered in the HA cluster but not replying.

 SNMP agent ha.node.dead[snsNbDeadNode.0]
HA: Synchronization status

MIB: STORMSHIELD-HA-MIB

Firewall configuration synchronization status:

1: Synced,

0: Not synced,

-1: Unknown/Error.

 SNMP agent ha.sync.status[snsHASyncStatus.0]
VPN: Number of dead VPN tunnels

MIB: STORMSHIELD-IPSEC-STATS-MIB

Number of dead security associations.

 SNMP agent vpn.tunnel.dead[snsIPSECStatsSADDead.0]
VPN: Number of dying VPN tunnels

MIB: STORMSHIELD-IPSEC-STATS-MIB

Number of security associations at end of life.

 SNMP agent vpn.tunnel.dying[snsIPSECStatsSADDying.0]
VPN: Number of mature VPN tunnels

MIB: STORMSHIELD-IPSEC-STATS-MIB

Number of established security associations.

 SNMP agent vpn.tunnel.mature[snsIPSECStatsSADMature.0]
VPN: Incoming policies

MIB: STORMSHIELD-IPSEC-STATS-MIB

Number of incoming security policies.

 SNMP agent ipsec.policies.in[snsIPSECStatsSPDIn.0]
VPN: Outgoing policies

MIB: STORMSHIELD-IPSEC-STATS-MIB

Number of outgoing security policies.

 SNMP agent ipsec.policies.out[snsIPSECStatsSPDOut.0]
Buffer memory

MIB: UCD-SNMP-MIB

Buffer memory in bytes.

 SNMP agent host.memory.buffer[memBuffer.0]

Preprocessing

  • Custom multiplier: 1000
Cached memory

MIB: UCD-SNMP-MIB

Cached memory in bytes.

 SNMP agent host.memory.cached[memCached.0]

Preprocessing

  • Custom multiplier: 1000
Free memory

MIB: UCD-SNMP-MIB

Free memory in bytes.

 SNMP agent host.memory.free[memAvailReal.0]

Preprocessing

  • Custom multiplier: 1000
Total memory

MIB: UCD-SNMP-MIB

Total physical memory (RAM) installed in bytes.

 SNMP agent host.memory.total[memTotalReal.0]

Preprocessing

  • Custom multiplier: 1000

  • Discard unchanged with heartbeat: 1h
Available memory

Available memory in bytes

(Available = Free + Cached + Buffer).

 Calculated host.memory.available
Used memory

Used memory in bytes.

 Calculated host.memory.used
Memory utilization

Memory utilization in %.

 Calculated host.memory.utilization
Active IPsec policy name

MIB: STORMSHIELD-POLICY-MIB

Active IPsec policy name.

 SNMP agent policy.ipsec[snsPolicySlotNameIPsec]

Preprocessing

  • Does not match regular expression: ^$

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 6h
Active filtering policy name

MIB: STORMSHIELD-POLICY-MIB

Active filtering policy name.

 SNMP agent policy.filter[snsPolicySlotName]

Preprocessing

  • Does not match regular expression: ^$

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 6h
Model

MIB: STORMSHIELD-PROPERTY-MIB

Firewall model.

 SNMP agent property.hardware.model[snsModel.0]

Preprocessing

  • Discard unchanged with heartbeat: 6h
System name

MIB: STORMSHIELD-PROPERTY-MIB

Stormshield Firewall system name.

 SNMP agent property.hardware.name[snsSystemName.0]
System node name

MIB: STORMSHIELD-PROPERTY-MIB

Stormshield Firewall system node name.

 SNMP agent property.hardware.node_name[snsSystemNodeName.0]

Preprocessing

  • Discard unchanged with heartbeat: 6h
Serial number

MIB: STORMSHIELD-PROPERTY-MIB

Stormshield Firewall serial number.

 SNMP agent property.hardware.serial[snsSerialNumber.0]
Version

MIB: STORMSHIELD-PROPERTY-MIB

Stormshield Firewall version.

 SNMP agent property.hardware.version[snsVersion.0]

Preprocessing

  • Discard unchanged with heartbeat: 6h
Date

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Stormshield Firewall current date (%Y-%m-%d %T).

 SNMP agent system.date[snsDate.0]
Uptime

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Stormshield Firewall uptime.

 SNMP agent system.hardware.uptime[snsUptime.0]

Preprocessing

  • JavaScript: The text is too long. Please see the template.
SNMP agent availability

Availability of SNMP checks on the host. The value of this item corresponds to the availability icons in the host list.

Possible values:

0 - not available

1 - available

2 - unknown.

 Zabbix internal zabbix[host,snmp,available]
SNMP traps (fallback)

Used for collecting all SNMP traps unmatched by other snmptrap items.

 SNMP trap snmptrap.fallback
ICMP ping

Host accessibility by ICMP.

0 - ICMP ping failed.

1 - ICMP ping successful.

 Simple check icmpping
ICMP loss

Percentage of lost packets.

 Simple check icmppingloss
ICMP response time

ICMP ping response time (in seconds).

 Simple check icmppingsec
Protected host memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Protected host memory utilization percentage.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.host[snsMemHost.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.2.0

    ⛔️Custom on fail: Discard value
Fragment memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Fragment memory utilization percentage.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.frag[snsMemFrag.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.3.0

    ⛔️Custom on fail: Discard value
ICMP memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

ICMP memory utilization percentage.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.icmp[snsMemIcmp.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.4.0

    ⛔️Custom on fail: Discard value
ASQ connection memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Utilization percentage of ASQ connection memory.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.conn[snsMemConn.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.5.0

    ⛔️Custom on fail: Discard value
Etherstate connection memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Utilization percentage of etherstate connection memory.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.ether[snsMemEther.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.6.0

    ⛔️Custom on fail: Discard value
Data tracking memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Utilization percentage of data tracking memory.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.data_track[snsMemDataTrack.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.7.0

    ⛔️Custom on fail: Discard value
System memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Current memory utilization percentage.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.system[snsMemSystem.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.8.0

    ⛔️Custom on fail: Discard value
User memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

User-space memory utilization percentage.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.user[snsMemUser.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.9.0

    ⛔️Custom on fail: Discard value
Socket memory utilization

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Socket memory utilization percentage.

Warning: This OID might not be functional for SNS versions lower than 5.0.

 Dependent item system.memory.mbuf[snsMemMbuf.0]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.10.1.10.0

    ⛔️Custom on fail: Discard value

Triggers

Name Description Expression Severity Dependencies and additional info
SNS: Faulty HA link

There is at least one faulty HA link.

 last(/Stormshield SNS by SNMP/ha.links.faulty[snsNbFaultyHALinks.0],#1)>0 Average
SNS: HA synchronization error

The cluster HA is not synchronized properly.

 last(/Stormshield SNS by SNMP/ha.sync.status[snsHASyncStatus.0],#1)<0 Average
SNS: High memory utilization

The system is running out of free memory.

 min(/Stormshield SNS by SNMP/host.memory.utilization,5m)>{$SNS.MEMORY.UTIL.MAX} Average
SNS: System name has changed

The name of the system has changed. Acknowledge to close the problem manually.

 last(/Stormshield SNS by SNMP/property.hardware.name[snsSystemName.0],#1)<>last(/Stormshield SNS by SNMP/property.hardware.name[snsSystemName.0],#2) and length(last(/Stormshield SNS by SNMP/property.hardware.name[snsSystemName.0]))>0 Info Manual close: Yes
SNS: Device has been replaced

Device serial number has changed. Acknowledge to close the problem manually.

 last(/Stormshield SNS by SNMP/property.hardware.serial[snsSerialNumber.0],#1)<>last(/Stormshield SNS by SNMP/property.hardware.serial[snsSerialNumber.0],#2) and length(last(/Stormshield SNS by SNMP/property.hardware.serial[snsSerialNumber.0]))>0 Info Manual close: Yes
SNS: Device has been restarted

Uptime is less than 10 minutes.

 last(/Stormshield SNS by SNMP/system.hardware.uptime[snsUptime.0])<10m Info
SNS: No SNMP data collection

SNMP is not available for polling. Please check device connectivity and SNMP settings.

 max(/Stormshield SNS by SNMP/zabbix[host,snmp,available],{$SNS.SNMP.TIMEOUT})=0 Warning Depends on:
  • SNS: Unavailable by ICMP ping
SNS: Unavailable by ICMP ping

Last three attempts returned timeout. Please check device connectivity.

 max(/Stormshield SNS by SNMP/icmpping,#3)=0 High
SNS: High ICMP ping loss

ICMP ping loss detected.

 min(/Stormshield SNS by SNMP/icmppingloss,5m)>{$SNS.ICMP.LOSS.WARN} and min(/Stormshield SNS by SNMP/icmppingloss,5m)<100 Warning Depends on:
  • SNS: Unavailable by ICMP ping
SNS: High ICMP ping response time

Average ICMP response time is too high.

 avg(/Stormshield SNS by SNMP/icmppingsec,5m)>{$SNS.ICMP.RESPONSE.TIME.WARN} Warning Depends on:
  • SNS: High ICMP ping loss
  • SNS: Unavailable by ICMP ping

LLD rule Autoupdate discovery

Name Description Type Key and additional info
Autoupdate discovery

Used for discovering updates from the Stormshield MIB.

 Dependent item update.auto.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Autoupdate discovery

Name Description Type Key and additional info
Autoupdate [{#UPDATE_NAME}]: Last update date

MIB: STORMSHIELD-AUTOUPDATE-MIB

Date of the last update of a subsystem.

 Dependent item system.update.last[snsAutoupdateLast.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.9.1.1.4.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 6h
Autoupdate [{#UPDATE_NAME}]: Update state

MIB: STORMSHIELD-AUTOUPDATE-MIB

State of the update of a subsystem.

 Dependent item system.update.state[snsAutoupdateState.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.9.1.1.3.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 6h

Trigger prototypes for Autoupdate discovery

Name Description Expression Severity Dependencies and additional info
SNS: Autoupdate [{#UPDATE_NAME}]: Not up to date

The autoupdate is not up to date (never started or started more than a year ago).

 (last(/Stormshield SNS by SNMP/system.update.state[snsAutoupdateState.{#SNMPINDEX}])=4) or (last(/Stormshield SNS by SNMP/system.update.state[snsAutoupdateState.{#SNMPINDEX}])=5) Info

LLD rule CPU temperature discovery

Name Description Type Key and additional info
CPU temperature discovery

Used for discovering the CPU temperature from the Stormshield MIB.

 Dependent item cpu.temperature.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for CPU temperature discovery

Name Description Type Key and additional info
CPU [{#CPU_ID}]: Temperature

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Temperature in degrees Celsius.

 Dependent item system.cpu.temperature[snsCpuTemp.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.7.1.2.{#SNMPINDEX}

LLD rule CPU usage discovery

Name Description Type Key and additional info
CPU usage discovery

Used for discovering the CPU usage from the Stormshield MIB.

 Dependent item cpu.usage.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for CPU usage discovery

Name Description Type Key and additional info
CPU [{#SNMPINDEX}]: Usage

MIB: HOST-RESOURCES-MIB

The average percentage of time that this processor was not idle over the last minute.

Implementations may approximate this one minute smoothing period if necessary.

Note that cpu 196608 = cpu 0, 196609 = 1, ...

 Dependent item system.cpu.usage[hrProcessorLoad.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.2.1.25.3.3.1.2.{#SNMPINDEX}

Trigger prototypes for CPU usage discovery

Name Description Expression Severity Dependencies and additional info
SNS: CPU [{#SNMPINDEX}]: CPU utilization too high

The CPU utilization is too high. The system might be slow to respond.

 min(/Stormshield SNS by SNMP/system.cpu.usage[hrProcessorLoad.{#SNMPINDEX}],5m)>{$SNS.CPU.UTIL.CRIT} High
SNS: CPU [{#SNMPINDEX}]: High CPU utilization

The CPU utilization is high. The system might be slow to respond.

 min(/Stormshield SNS by SNMP/system.cpu.usage[hrProcessorLoad.{#SNMPINDEX}],5m)>{$SNS.CPU.UTIL.WARN} Warning Depends on:
  • SNS: CPU [{#SNMPINDEX}]: CPU utilization too high

LLD rule Disk discovery

Name Description Type Key and additional info
Disk discovery

Used for discovering disks from the Stormshield MIB.

 Dependent item disk.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Disk discovery

Name Description Type Key and additional info
Disk [{#DISK_ID}]: Disk name

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Name of the disk.

 Dependent item system.disk.name[snsDiskEntryDiskName.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.5.1.2.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 6h
Disk [{#DISK_ID}]: Member of a RAID array

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Indicates whether the disk is part of a RAID array.

 Dependent item system.disk.RAID[snsDiskEntryIsRaid.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.5.1.4.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 1h
Disk [{#DISK_ID}]: RAID status

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

RAID status.

 Dependent item system.disk.status[snsDiskEntryRaidStatus.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.5.1.5.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Disk [{#DISK_ID}]: SMART info test result

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Result of the SMART diagnostic tests.

 Dependent item system.disk.result[snsDiskEntrySmartResult.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.5.1.3.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.

LLD rule Fan discovery

Name Description Type Key and additional info
Fan discovery

Used for discovering the fan from the Stormshield MIB.

 Dependent item fan.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Fan discovery

Name Description Type Key and additional info
Fan [{#FAN_ID}]: Fan name

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Name of the fan.

 Dependent item system.fan.name[snsFanName.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.9.1.2.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 6h
Fan [{#FAN_ID}]: Fan status

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Status of the fan.

 Dependent item system.fan.status[snsFanStatus.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.9.1.3.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h
Fan [{#FAN_ID}]: Fan speed

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Speed of the fan.

 Dependent item system.fan.speed[snsFanRpm.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.9.1.4.{#SNMPINDEX}

LLD rule HA members discovery

Name Description Type Key and additional info
HA members discovery

Used for discovering HA members from the Stormshield MIB.

 Dependent item ha.members.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for HA members discovery

Name Description Type Key and additional info
HA members [{#HA_ID}]: Firewall active/passive

MIB: STORMSHIELD-HA-MIB

Indicates whether the firewall is active.

 Dependent item ha.active[snsHAActive.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.10.{#SNMPINDEX}
HA members [{#HA_ID}]: HA licence

MIB: STORMSHIELD-HA-MIB

HA licence.

 Dependent item ha.license[snsHALicence.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.6.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
HA members [{#HA_ID}]: Firewall model

MIB: STORMSHIELD-HA-MIB

Firewall model.

 Dependent item ha.model[snsModel.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.4.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 6h
HA members [{#HA_ID}]: Is online

MIB: STORMSHIELD-HA-MIB

Firewall is online.

 Dependent item ha.online[snsOnline.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.3.{#SNMPINDEX}
HA members [{#HA_ID}]: HA priority

MIB: STORMSHIELD-HA-MIB

HA priority.

 Dependent item ha.priority[snsHAPriority.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.8.{#SNMPINDEX}
HA members [{#HA_ID}]: HA quality

MIB: STORMSHIELD-HA-MIB

HA quality.

 Dependent item ha.quality[snsHAQuality.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.7.{#SNMPINDEX}
HA members [{#HA_ID}]: Firewall serial

MIB: STORMSHIELD-HA-MIB

Firewall serial number.

 Dependent item ha.serial[snsFwSerial.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.2.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 6h
HA members [{#HA_ID}]: Firewall status

MIB: STORMSHIELD-HA-MIB

HA status forced:

-2: Unknown forced status

-1: No peer found

0: No forced status

1: Forced active

2: Forced passive

 Dependent item ha.status[snsHAStatusForced.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.9.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 1h
HA members [{#HA_ID}]: Firewall uptime

MIB: STORMSHIELD-HA-MIB

Firewall uptime.

 Dependent item ha.uptime[snsHAUptime.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.11.7.1.11.{#SNMPINDEX}

LLD rule Health status discovery

Name Description Type Key and additional info
Health status discovery

Used for discovering the health status from the Stormshield MIB.

 Dependent item health.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Health status discovery

Name Description Type Key and additional info
Health status firewall [{#HEALTH_ID}]: Certificates

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall.

 Dependent item health.certificates.status[snsCertHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.11.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: CPU

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall CPU:

- Good if CPU load is 90% or lower

- Minor if CPU load is above 90% for less than 5 minutes

- Major if CPU load is above 90% for more than 5 minutes

 Dependent item health.cpu.status[snsCpuHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.7.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: CPU temperature

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall CPU temperature:

- Good; at least 20°C below max temperature

- Minor; less than 20°C below max temperature

- Major; 5°C below max temperature

 Dependent item health.cpu.temperature[snsCpuTempHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.15.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: CRLs

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield firewall CRLs.

 Dependent item health.crl.status[snsCRLHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.12.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: Disk

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall disk:

- Good if the disks are working correctly

- Minor if the disks are not working correctly

- Major if the disks are not working correctly and have raised an alarm

 Dependent item health.disk.status[snsDiskHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.9.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: Fans

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall fans:

- Good if the fans are working correctly

- Minor if the fans are not working correctly

- Major if the fans are not working correctly and have raised an alarm

 Dependent item health.fan.status[snsFanHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.6.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: HA link

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall HA link:

- Good if the HA link is working correctly

- Minor if the HA link is not working correctly (may be down)

- Major if the HA link is not working (is down)

 Dependent item health.ha.link.status[snsHaLinkHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.4.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: HA mode

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current status of Stormshield Firewall HA mode:

- None if HA is not active

- Active if the firewall is the active status

- Passive if the firewall is the passive status

 Dependent item health.ha.mode.status[snsHaModeHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.3.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: Memory

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall memory:

- Good if memory load is 80% or lower

- Minor if memory load is above 80% for less than 15 minutes

- Major if memory load is above 80% for more than 15 minutes

 Dependent item health.memory.status[snsMemHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.8.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: Admin password

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall Admin Password:

- Good if the date when the admin password was last changed is less than a year ago

- Minor if the date when the admin password was last changed is more than a year ago

- Major if the admin password is the default password

 Dependent item health.password.status[snsPasswdHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.14.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: Power supply

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall power supply:

- Good if the power supply is working correctly

- Minor if the power supply is not working correctly

- Major if the power supply is not working correctly and has raised an alarm.

 Dependent item health.power.status[snsPowerSupplyHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.5.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.
Health status firewall [{#HEALTH_ID}]: RAID

MIB: STORMSHIELD-HEALTH-MONITOR-MIB

Current health status of Stormshield Firewall RAID:

- Good if the RAID is working in optimal mode

- Minor if the RAID is not working in optimal mode

- Major if the RAID is not working in optimal mode and has raised an alarm

 Dependent item health.raid.status[snsRaidHealth.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.16.2.1.10.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.

Trigger prototypes for Health status discovery

Name Description Expression Severity Dependencies and additional info
SNS: Health status firewall [{#HEALTH_ID}]: CPU is overheating

The CPU is not working correctly and has raised an alarm.

 last(/Stormshield SNS by SNMP/health.cpu.temperature[snsCpuTempHealth.{#SNMPINDEX}])=5 High
SNS: Health status firewall [{#HEALTH_ID}]: The disk is not working correctly

The disks are not working correctly and have raised an alarm.

 last(/Stormshield SNS by SNMP/health.disk.status[snsDiskHealth.{#SNMPINDEX}])=5 High
SNS: Health status firewall [{#HEALTH_ID}]: The fan is not working correctly

The fans are not working correctly and have raised an alarm.

 last(/Stormshield SNS by SNMP/health.fan.status[snsFanHealth.{#SNMPINDEX}])=5 Average
SNS: Health status firewall [{#HEALTH_ID}]: HA link is down

The HA link is not working (is down).

 last(/Stormshield SNS by SNMP/health.ha.link.status[snsHaLinkHealth.{#SNMPINDEX}])=5 High
SNS: Health status firewall [{#HEALTH_ID}]: Admin password is not secured

The admin password is the default password; please change it.

 last(/Stormshield SNS by SNMP/health.password.status[snsPasswdHealth.{#SNMPINDEX}])=5 High
SNS: Health status firewall [{#HEALTH_ID}]: The power supply is not working correctly

The power supply is not working correctly and has raised an alarm.

 last(/Stormshield SNS by SNMP/health.power.status[snsPowerSupplyHealth.{#SNMPINDEX}])=5 High
SNS: Health status firewall [{#HEALTH_ID}]: The RAID is not working correctly

The RAID is not working in optimal mode and has raised an alarm.

 last(/Stormshield SNS by SNMP/health.raid.status[snsRaidHealth.{#SNMPINDEX}])=5 Average

LLD rule Network interface discovery

Name Description Type Key and additional info
Network interface discovery

Used for discovering network interfaces from the Stormshield MIB.

 Dependent item network.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Network interface discovery

Name Description Type Key and additional info
Interface [{#IF_NAME}]: System interface name

MIB: STORMSHIELD-IF-MIB

System interface name.

 Dependent item net.if.name[snsifName.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.3.{#SNMPINDEX}

  • Discard unchanged with heartbeat: 6h
Interface [{#IF_NAME}]: Interface protected

MIB: STORMSHIELD-IF-MIB

Indicates whether the interface is protected.

 Dependent item net.if.protected[snsifProtected.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.37.{#SNMPINDEX}
Interface [{#IF_NAME}]: Accepted packets

MIB: STORMSHIELD-IF-MIB

Number of accepted packets.

 Dependent item net.if.accepted[snsifPktAccepted.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.11.{#SNMPINDEX}
Interface [{#IF_NAME}]: Blocked packets

MIB: STORMSHIELD-IF-MIB

Number of packets that have been blocked.

 Dependent item net.if.blocked[snsifPktBlocked.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.12.{#SNMPINDEX}
Interface [{#IF_NAME}]: TCP connection established

MIB: STORMSHIELD-IF-MIB

TCP connection established.

 Dependent item net.if.established[snsifTcpConn.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.21.{#SNMPINDEX}
Interface [{#IF_NAME}]: UDP connection established

MIB: STORMSHIELD-IF-MIB

UDP connection established.

 Dependent item net.if.established[snsifUdpConn.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.22.{#SNMPINDEX}
Interface [{#IF_NAME}]: Incoming current throughput

MIB: STORMSHIELD-IF-MIB

Current incoming throughput in B/s.

 Dependent item net.if.in[snsifInCurThroughput.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.25.{#SNMPINDEX}
Interface [{#IF_NAME}]: Outgoing current throughput

MIB: STORMSHIELD-IF-MIB

Current outgoing throughput in B/s.

 Dependent item net.if.out[snsifOutCurThroughput.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.26.{#SNMPINDEX}
Interface [{#IF_NAME}]: Incoming data bytes

MIB: STORMSHIELD-IF-MIB

Incoming data bytes.

 Dependent item net.if.in[snsifInTotalBytes.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.29.{#SNMPINDEX}
Interface [{#IF_NAME}]: Outgoing data bytes

MIB: STORMSHIELD-IF-MIB

Outgoing data bytes.

 Dependent item net.if.out[snsifOutTotalBytes.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.30.{#SNMPINDEX}
Interface [{#IF_NAME}]: Incoming TCP data bytes

MIB: STORMSHIELD-IF-MIB

Incoming TCP data bytes.

 Dependent item net.if.in[snsifInTcpBytes.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.31.{#SNMPINDEX}
Interface [{#IF_NAME}]: Outgoing TCP data bytes

MIB: STORMSHIELD-IF-MIB

Outgoing TCP data bytes.

 Dependent item net.if.out[snsifOutTcpBytes.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.32.{#SNMPINDEX}
Interface [{#IF_NAME}]: Incoming UDP data bytes

MIB: STORMSHIELD-IF-MIB

Incoming UDP data bytes.

 Dependent item net.if.in[snsifInUdpBytes.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.33.{#SNMPINDEX}
Interface [{#IF_NAME}]: Outgoing UDP data bytes

MIB: STORMSHIELD-IF-MIB

Outgoing UDP data bytes.

 Dependent item net.if.out[snsifOutUdpBytes.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.34.{#SNMPINDEX}
Interface [{#IF_NAME}]: Max input flow rate

MIB: STORMSHIELD-IF-MIB

Maximum incoming throughput in B/s.

 Dependent item net.if.in.max[snsifInMaxThroughput.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.27.{#SNMPINDEX}
Interface [{#IF_NAME}]: Max output flow rate

MIB: STORMSHIELD-IF-MIB

Maximum outgoing throughput in B/s.

 Dependent item net.if.max_out[snsifOutMaxThroughput.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.28.{#SNMPINDEX}
Interface [{#IF_NAME}]: Current TCP connection count

MIB: STORMSHIELD-IF-MIB

Current TCP connection count.

 Dependent item net.if.TCP_count[snsifTcpConnCount.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.23.{#SNMPINDEX}
Interface [{#IF_NAME}]: Current UDP connection count

MIB: STORMSHIELD-IF-MIB

Current UDP connection count.

 Dependent item net.if.UDP_count[snsifUdpConnCount.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.4.1.1.24.{#SNMPINDEX}

LLD rule Power supply discovery

Name Description Type Key and additional info
Power supply discovery

Used for discovering power supplies from the Stormshield MIB.

 Dependent item psu.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Power supply discovery

Name Description Type Key and additional info
PSU [{#POWER_ID}]: Power status

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Indicates whether the power supply is powered by electricity.

 Dependent item system.psu.power[snsPowerSupplyPowered.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.6.1.2.{#SNMPINDEX}
PSU [{#POWER_ID}]: Status

MIB: STORMSHIELD-SYSTEM-MONITOR-MIB

Indicates the status of the power supply.

 Dependent item system.psu.status[snsPowerSupplyStatus.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.4.1.11256.1.10.6.1.3.{#SNMPINDEX}

  • JavaScript: The text is too long. Please see the template.

LLD rule Storage discovery

Name Description Type Key and additional info
Storage discovery

Used for discovering storage from the Stormshield MIB.

 Dependent item storage.discovery

Preprocessing

  • SNMP walk to JSON

  • Discard unchanged with heartbeat: 1h

Item prototypes for Storage discovery

Name Description Type Key and additional info
Storage [{#STORAGE_DESCR}]: Storage size

MIB: HOST-RESOURCES-MIB

Total memory in the data file in bytes.

 Dependent item host.storage.size[hrStorageSizedata.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.2.1.25.2.3.1.5.{#SNMPINDEX}

  • Custom multiplier: 4096
Storage [{#STORAGE_DESCR}]: Used storage

MIB: HOST-RESOURCES-MIB

Used memory in the data file in bytes.

 Dependent item host.storage.used[hrStorageUseddata.{#SNMPINDEX}]

Preprocessing

  • SNMP walk value: 1.3.6.1.2.1.25.2.3.1.6.{#SNMPINDEX}

  • Custom multiplier: 4096
Storage [{#STORAGE_DESCR}]: Utilization

Memory utilization in %.

 Calculated host.storage.utilization[.{#SNMPINDEX}]

Trigger prototypes for Storage discovery

Name Description Expression Severity Dependencies and additional info
SNS: Storage [{#STORAGE_DESCR}]: Utilization is high

The data file is running out of free memory.

 min(/Stormshield SNS by SNMP/host.storage.utilization[.{#SNMPINDEX}],5m)>{$SNS.MEMORY.UTIL.MAX} Average

Feedback

Please report any issues with the template at https://support.zabbix.com

You can also provide feedback, discuss the template, or ask for help at ZABBIX forums

Articles and documentation

+ Propose new article

Didn't find what you are looking for?

Request custom integration

Zabbix integration team will develop custom integration based on your requirements and Zabbix best practices.

Request

Purchase Integration Service

Have you already developed high quality integration and want to submit to Zabbix integration repository?

Propose