OID reference

executionAnomaly

1.3.6.1.4.1.25597.3.0.2

Description

Execution anomaly detected

Full description and source information

Identification

Identifier and names

Parent: 1.3.6.1.4.1.25597.3.0 (notificationPrefix)
Node code: 2
Node name: executionAnomaly
Category: SNMP notification
Numeric OID: 1.3.6.1.4.1.25597.3.0.2
URN notation: urn:oid:1.3.6.1.4.1.25597.3.0.2

ASN.1, OID-IRI and named path variants

ASN.1 notation

{1 3 6 1 4 1 25597 3 0 2}

{iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) identified-organization(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) identified-organization(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) org(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) org(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) org(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) org(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-identified-organization(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) enterprises(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) ldap-enterprise(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}
{iso(1) iso-organization(3) dod(6) internet(1) private(4) vendor-objects(1) fireeye(25597) notifications(3) notificationPrefix(0) executionAnomaly(2)}

OID-IRI notation

/1/3/6/1/4/1/25597/3/0/2
/ISO/Identified-Organization/6/1/4/1/25597/3/0/2
/ISO/3/6/1/4/1/25597/3/0/2

Named path variants

/iso/identified-organization/dod/internet/private/enterprise/25597/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/enterprise/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/enterprises/25597/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/enterprises/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/ldap-enterprise/25597/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/ldap-enterprise/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/vendor-objects/25597/notifications/notificationPrefix/executionAnomaly
/iso/identified-organization/dod/internet/private/vendor-objects/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/enterprise/25597/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/enterprise/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/enterprises/25597/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/enterprises/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/ldap-enterprise/25597/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/ldap-enterprise/fireeye/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/vendor-objects/25597/notifications/notificationPrefix/executionAnomaly
/iso/org/dod/internet/private/vendor-objects/fireeye/notifications/notificationPrefix/executionAnomaly
Additional combinations skipped.

Published definition

The displayed source records contain one distinct definition. Compare its source records.

executionAnomaly NOTIFICATION-TYPE
    OBJECTS { 
        eventIndex,
        eventId,
        eventType,
        eventDate,
        eventTime,
        eventTraceId,
        eventSrcIp,
        eventDstIp,
        eventSrcMac,
        eventDstMac,
        eventDstPort,
        eventVlan,
        eventProtocol,
        eventProfileId,
        eventOsInfo,
        eventService,
        eventAttackType,
        eventSrcHost,
        eventSrcAddrType,
        eventSrcAddr,
        eventDstAddrType,
        eventDstAddr
    }
    STATUS  current
    DESCRIPTION
            "Execution anomaly detected"
    ::= { notificationPrefix 2 }

Meaning

Descriptions

1 unique

Identical descriptions are grouped. Different wording and device-specific notes are retained.

Execution anomaly detected

Sources for this description

Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community)

See 1 matching source record

Evidence

Source records

1 records

Matching descriptions are grouped; open a group to compare definitions and supporting files.

Records for description 1Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community)1 record · 2 sources

Description 1

executionAnomaly · currentMultiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community)2 sources

Status in source: current.

Names: executionAnomaly

Technical details

{
  "smi_kind": "NOTIFICATION-TYPE",
  "definition": [
    "executionAnomaly",
    "NOTIFICATION-TYPE",
    "OBJECTS",
    "{",
    "eventIndex",
    ",",
    "eventId",
    ",",
    "eventType",
    ",",
    "eventDate",
    ",",
    "eventTime",
    ",",
    "eventTraceId",
    ",",
    "eventSrcIp",
    ",",
    "eventDstIp",
    ",",
    "eventSrcMac",
    ",",
    "eventDstMac",
    ",",
    "eventDstPort",
    ",",
    "eventVlan",
    ",",
    "eventProtocol",
    ",",
    "eventProfileId",
    ",",
    "eventOsInfo",
    ",",
    "eventService",
    ",",
    "eventAttackType",
    ",",
    "eventSrcHost",
    ",",
    "eventSrcAddrType",
    ",",
    "eventSrcAddr",
    ",",
    "eventDstAddrType",
    ",",
    "eventDstAddr",
    "}",
    "STATUS",
    "current",
    "DESCRIPTION",
    "\"Execution anomaly detected\"",
    "::=",
    "{",
    "notificationPrefix",
    "2",
    "}"
  ],
  "syntax_tree": [
    [
      "Objects",
      [
        "eventIndex",
        "eventId",
        "eventType",
        "eventDate",
        "eventTime",
        "eventTraceId",
        "eventSrcIp",
        "eventDstIp",
        "eventSrcMac",
        "eventDstMac",
        "eventDstPort",
        "eventVlan",
        "eventProtocol",
        "eventProfileId",
        "eventOsInfo",
        "eventService",
        "eventAttackType",
        "eventSrcHost",
        "eventSrcAddrType",
        "eventSrcAddr",
        "eventDstAddrType",
        "eventDstAddr"
      ]
    ],
    [
      "Status",
      "current"
    ],
    [
      "DESCRIPTION",
      "Execution anomaly detected"
    ],
    null
  ]
}

Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community) · Publisher's source file: FE-FIREEYE-MIB
Vendor MIB copy from the LibreNMS archive.

Module: FE-FIREEYE-MIB

See published definition above
Module imports
```
{'HCNUM-TC': ['CounterBasedGauge64'], 'SNMPv2-TC': ['TruthValue'], 'SNMPv2-SMI': ['MODULE-IDENTITY', 'OBJECT-TYPE', 'NOTIFICATION-TYPE', 'enterprises', 'Integer32', 'Unsigned32', 'Counter32', 'Counter64', 'IpAddress', 'Gauge32'], 'SNMPv2-CONF': ['MODULE-COMPLIANCE', 'OBJECT-GROUP', 'NOTIFICATION-GROUP'], 'INET-ADDRESS-MIB': ['InetAddressType', 'InetAddress']}
```
· Download FE-FIREEYE-MIB
Related source files and packages:
- LibreNMS original distribution archive
- Archive revision metadata: librenms/librenms (JSON)
Multiple manufacturers; see the original MIB MIB copies (LibreNMS/Observium Community) · Publisher's source file: Source package: observium-community-latest.tar.gz
Vendor MIB copy from the Observium Community archive.

Module: FE-FIREEYE-MIB

Same published definition
Module imports
```
{'HCNUM-TC': ['CounterBasedGauge64'], 'SNMPv2-TC': ['TruthValue'], 'SNMPv2-SMI': ['MODULE-IDENTITY', 'OBJECT-TYPE', 'NOTIFICATION-TYPE', 'enterprises', 'Integer32', 'Unsigned32', 'Counter32', 'Counter64', 'IpAddress', 'Gauge32'], 'SNMPv2-CONF': ['MODULE-COMPLIANCE', 'OBJECT-GROUP', 'NOTIFICATION-GROUP'], 'INET-ADDRESS-MIB': ['InetAddressType', 'InetAddress']}
```
· Download FE-FIREEYE-MIB
Related source files and packages:
- Observium Community original distribution archive

Registration

Registration authorities

First Registration Authority (inferred from ancestor 1.3.6.1.4.1.25597)

Jordan Blake

Siblings (7)

OID	Name	Direct children	Descendants	Description
1.3.6.1.4.1.25597.3.0.1	fireeyeAlert	0	0
1.3.6.1.4.1.25597.3.0.3	networkAnomaly	0	0
1.3.6.1.4.1.25597.3.0.4	signatureMatch	0	0
1.3.6.1.4.1.25597.3.0.9	ccConnect	0	0
1.3.6.1.4.1.25597.3.0.10	ccSigmatch	0	0
1.3.6.1.4.1.25597.3.0.11	osChange	0	0
1.3.6.1.4.1.25597.3.0.12	ipsAlert	0	0