OID reference

ipsAlert

1.3.6.1.4.1.25597.3.0.12

Description

IPS anomaly detected.

Full description and source information

Identification

Identifier and names

Parent: 1.3.6.1.4.1.25597.3.0 (notificationPrefix)
Node code: 12
Node name: ipsAlert
Category: SNMP notification
Numeric OID: 1.3.6.1.4.1.25597.3.0.12
URN notation: urn:oid:1.3.6.1.4.1.25597.3.0.12

ASN.1, OID-IRI and named path variants

ASN.1 notation

{1 3 6 1 4 1 25597 3 0 12}

{iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) identified-organization(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) identified-organization(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) org(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) org(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) org(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) org(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) ipsAlert(12)}

OID-IRI notation

/1/3/6/1/4/1/25597/3/0/12
/ISO/Identified-Organization/6/1/4/1/25597/3/0/12
/ISO/3/6/1/4/1/25597/3/0/12

Named path variants

/iso/identified-organization/dod/internet/private/enterprise/25597/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/enterprise/fireeye/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/enterprises/25597/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/enterprises/fireeye/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/ldap-enterprise/25597/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/ldap-enterprise/fireeye/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/vendor-objects/25597/notifications/notificationPrefix/ipsAlert
/iso/identified-organization/dod/internet/private/vendor-objects/fireeye/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/enterprise/25597/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/enterprise/fireeye/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/enterprises/25597/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/enterprises/fireeye/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/ldap-enterprise/25597/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/ldap-enterprise/fireeye/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/vendor-objects/25597/notifications/notificationPrefix/ipsAlert
/iso/org/dod/internet/private/vendor-objects/fireeye/notifications/notificationPrefix/ipsAlert
Additional combinations skipped.

Published definition

The displayed source records contain one distinct definition. Compare its source records.

ipsAlert NOTIFICATION-TYPE
    OBJECTS {
        eventIndex,
        eventId,
        eventType,
        eventTime,
        eventSrcAddrType,
        eventSrcAddr,
        eventSrcPort,
        eventSrcMac,
        eventDstAddrType,
        eventDstAddr,
        eventDstPort,
        eventDstMac,
        ipsSignatureId,
        ipsSignatureRevision,
        ipsMatchCount,
        ipsSeverity,
        ipsSignatureName,
        ipsReferenceId,
        ipsBlockMode,
        ipsAttackTarget,
        alertSensorProduct, 
        alertSensorHost,
        alertSensorRelease,
        alertUrl
    }
    STATUS  current
    DESCRIPTION
            "IPS anomaly detected."
    ::= { notificationPrefix 12 }

Meaning

Descriptions

1 unique

Identical descriptions are grouped. Different wording and device-specific notes are retained.

IPS anomaly detected.

Sources for this description

Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community)

See 1 matching source record

Evidence

Source records

1 records

Matching descriptions are grouped; open a group to compare definitions and supporting files.

Records for description 1Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community)1 record · 2 sources

Description 1

ipsAlert · currentMultiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community)2 sources

Status in source: current.

Names: ipsAlert

Technical details

{
  "smi_kind": "NOTIFICATION-TYPE",
  "definition": [
    "ipsAlert",
    "NOTIFICATION-TYPE",
    "OBJECTS",
    "{",
    "eventIndex",
    ",",
    "eventId",
    ",",
    "eventType",
    ",",
    "eventTime",
    ",",
    "eventSrcAddrType",
    ",",
    "eventSrcAddr",
    ",",
    "eventSrcPort",
    ",",
    "eventSrcMac",
    ",",
    "eventDstAddrType",
    ",",
    "eventDstAddr",
    ",",
    "eventDstPort",
    ",",
    "eventDstMac",
    ",",
    "ipsSignatureId",
    ",",
    "ipsSignatureRevision",
    ",",
    "ipsMatchCount",
    ",",
    "ipsSeverity",
    ",",
    "ipsSignatureName",
    ",",
    "ipsReferenceId",
    ",",
    "ipsBlockMode",
    ",",
    "ipsAttackTarget",
    ",",
    "alertSensorProduct",
    ",",
    "alertSensorHost",
    ",",
    "alertSensorRelease",
    ",",
    "alertUrl",
    "}",
    "STATUS",
    "current",
    "DESCRIPTION",
    "\"IPS anomaly detected.\"",
    "::=",
    "{",
    "notificationPrefix",
    "12",
    "}"
  ],
  "syntax_tree": [
    [
      "Objects",
      [
        "eventIndex",
        "eventId",
        "eventType",
        "eventTime",
        "eventSrcAddrType",
        "eventSrcAddr",
        "eventSrcPort",
        "eventSrcMac",
        "eventDstAddrType",
        "eventDstAddr",
        "eventDstPort",
        "eventDstMac",
        "ipsSignatureId",
        "ipsSignatureRevision",
        "ipsMatchCount",
        "ipsSeverity",
        "ipsSignatureName",
        "ipsReferenceId",
        "ipsBlockMode",
        "ipsAttackTarget",
        "alertSensorProduct",
        "alertSensorHost",
        "alertSensorRelease",
        "alertUrl"
      ]
    ],
    [
      "Status",
      "current"
    ],
    [
      "DESCRIPTION",
      "IPS anomaly detected."
    ],
    null
  ]
}

Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community) · Publisher's source file: FE-FIREEYE-MIB
Vendor MIB copy from the LibreNMS archive.

Module: FE-FIREEYE-MIB

See published definition above
Module imports
```
{'HCNUM-TC': ['CounterBasedGauge64'], 'SNMPv2-TC': ['TruthValue'], 'SNMPv2-SMI': ['MODULE-IDENTITY', 'OBJECT-TYPE', 'NOTIFICATION-TYPE', 'enterprises', 'Integer32', 'Unsigned32', 'Counter32', 'Counter64', 'IpAddress', 'Gauge32'], 'SNMPv2-CONF': ['MODULE-COMPLIANCE', 'OBJECT-GROUP', 'NOTIFICATION-GROUP'], 'INET-ADDRESS-MIB': ['InetAddressType', 'InetAddress']}
```
· Download FE-FIREEYE-MIB
Related source files and packages:
- LibreNMS original distribution archive
- Archive revision metadata: librenms/librenms (JSON)
Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community) · Publisher's source file: Source package: observium-community-latest.tar.gz
Vendor MIB copy from the Observium Community archive.

Module: FE-FIREEYE-MIB

Same published definition
Module imports
```
{'HCNUM-TC': ['CounterBasedGauge64'], 'SNMPv2-TC': ['TruthValue'], 'SNMPv2-SMI': ['MODULE-IDENTITY', 'OBJECT-TYPE', 'NOTIFICATION-TYPE', 'enterprises', 'Integer32', 'Unsigned32', 'Counter32', 'Counter64', 'IpAddress', 'Gauge32'], 'SNMPv2-CONF': ['MODULE-COMPLIANCE', 'OBJECT-GROUP', 'NOTIFICATION-GROUP'], 'INET-ADDRESS-MIB': ['InetAddressType', 'InetAddress']}
```
· Download FE-FIREEYE-MIB
Related source files and packages:
- Observium Community original distribution archive

Registration

Registration authorities

First Registration Authority (inferred from ancestor 1.3.6.1.4.1.25597)

Jordan Blake

Siblings (7)

OID	Name	Direct children	Descendants	Description
1.3.6.1.4.1.25597.3.0.1	fireeyeAlert	0	0
1.3.6.1.4.1.25597.3.0.2	executionAnomaly	0	0
1.3.6.1.4.1.25597.3.0.3	networkAnomaly	0	0
1.3.6.1.4.1.25597.3.0.4	signatureMatch	0	0
1.3.6.1.4.1.25597.3.0.9	ccConnect	0	0
1.3.6.1.4.1.25597.3.0.10	ccSigmatch	0	0
1.3.6.1.4.1.25597.3.0.11	osChange	0	0