One Hat Cyber Team

View File Name : palo-alto.yaml

# Profile for Palo Alto devices

# https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/snmp-monitoring-and-traps/supported-mibs/pan-common-mibmy.html#idaeaa4a59-0bf4-4f66-90cf-9c0096c6f8a4
# https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/9-1/pan-os-admin/pan-os-admin.pdf

# Example sysDescr:
#  - Palo Alto Networks VM-Series firewall
#  - Palo Alto Networks PA-220 series firewall
#  - Palo Alto Networks PA-800 series firewall
#  - Palo Alto Networks PA-3200 series firewall
#  - Palo Alto Networks WildFire Appliance
#  - Palo Alto Networks PA-800 series firewall
#  - Palo Alto Networks PA-3000 series firewall

extends:
  - _palo-alto.yaml
  - _std-if-mib.yaml
  - _std-host-resources-mib.yaml
  - _std-ospf-mib.yaml
  - _std-tcp-mib.yaml
  - _std-udp-mib.yaml
  - _std-ip-mib.yaml

# All Palo Alto Networks sysObjectID start with `1.3.6.1.4.1.25461.2.3` (panMibs)
selector:
  - sysobjectid:
      include:
        - 1.3.6.1.4.1.25461.2.3.*

# Note related to use of index `1` of entPhysicalTable columns:
# Based on snmpwalks of Palo Alto Networks devices, the main/chassis hardware have the index `1`
# Librennms is also using index `1`: https://github.com/librenms/librenms/blob/1ac60e3b1d90616119f3c4adc28213e3c35c2477/includes/definitions/discovery/arista_eos.yaml#L4
metadata:
  device:
    fields:
      serial_number:
        symbol:
          OID: 1.3.6.1.4.1.25461.2.1.2.1.3.0
          name: panSysSerialNumber # The serial number of the unit. If not available, an empty string is returned.
      version:
        symbol:
          OID: 1.3.6.1.4.1.25461.2.1.2.1.1.0
          name:
            panSysSwVersion # Full software version. The first two components of the full version are the major
          # and minor versions. The third component indicates the maintenance release number
          # and the fourth, the build number.
      product_name:
        symbol:
          OID: 1.3.6.1.2.1.1.1.0
          name: sysDescr
          match_pattern: 'Palo Alto Networks\s+(PA-\d+ series firewall|WildFire Appliance|VM-Series firewall)'
          match_value: "$1"
          # Examples:
          #  - Palo Alto Networks VM-Series firewall
          #  - Palo Alto Networks PA-3200 series firewall
          #  - Palo Alto Networks WildFire Appliance
      model:
        symbol:
          OID: 1.3.6.1.4.1.25461.2.1.2.2.1.0
          name: panChassisType
          # Examples:
          #  - PA-3020
      os_name:
        # "PAN‑OS® is the software that runs all Palo Alto Networks® next-generation firewalls."
        # Source https://docs.paloaltonetworks.com/pan-os.html
        value: "PAN-OS"
      os_version:
        symbol:
          OID: 1.3.6.1.4.1.25461.2.1.2.1.1.0
          name:
            panSysSwVersion # Full software version. The first two components of the full version are the major
          # and minor versions. The third component indicates the maintenance release number
          # and the fourth, the build number.
      type:
        value: Firewall
      vendor:
        value: Palo Alto Networks

# PAN-COMMON-MIB
# https://mibbrowser.online/mibdb_search.php?mib=PAN-COMMON-MIB
# https://github.com/DanielleHuisman/observium-community-edition/blob/main/mibs/paloalto/PAN-COMMON-MIB

# PAN-ENTITY-EXT-MIB
# https://mibbrowser.online/mibdb_search.php?mib=PAN-ENTITY-EXT-MIB
# https://github.com/DanielleHuisman/observium-community-edition/blob/main/mibs/paloalto/PAN-ENTITY-EXT-MIB

metrics:
  #
  # Session Utilization Metrics
  #

  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.1.0
      name: panSessionUtilization
      chart_meta:
        description: Session table utilization percentage
        family: 'System/Activity/Session/Utilization'
        unit: "%"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.2.0
      name: panSessionMax
      chart_meta:
        description: Total number of sessions supported
        family: 'System/Activity/Session/Maximum'
        unit: "{session}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.3.0
      name: panSessionActive
      chart_meta:
        description: Total number of active sessions
        family: 'System/Activity/Session/Active/Total'
        unit: "{session}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.4.0
      name: panSessionActiveTcp
      chart_meta:
        description: Total number of active TCP sessions
        family: 'System/Activity/Session/Active/TCP'
        unit: "{session}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.5.0
      name: panSessionActiveUdp
      chart_meta:
        description: Total number of active UDP sessions
        family: 'System/Activity/Session/Active/UDP'
        unit: "{session}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.6.0
      name: panSessionActiveICMP
      chart_meta:
        description: Total number of active ICMP sessions
        family: 'System/Activity/Session/Active/ICMP'
        unit: "{session}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.7.0
      name: panSessionActiveSslProxy
      chart_meta:
        description: Total number of active SSL proxy sessions
        family: 'System/Activity/Session/SSLProxy/Active'
        unit: "{session}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.3.8.0
      name: panSessionSslProxyUtilization
      chart_meta:
        description: SSL proxy session utilization percentage
        family: 'System/Activity/Session/SSLProxy/Utilization'
        unit: "%"

  #
  # GlobalProtect gateway utilization
  #
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.5.1.1.0
      name: panGPGWUtilizationPct
      chart_meta:
        description: GlobalProtect Gateway utilization percentage
        family: 'Network/VPN/GlobalProtect/Gateway/Utilization'
        unit: "%"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.5.1.2.0
      name: panGPGWUtilizationMaxTunnels
      chart_meta:
        description: Max tunnels allowed
        family: 'Network/VPN/GlobalProtect/Gateway/Tunnel/Maximum'
        unit: "{tunnel}"
  - MIB: PAN-COMMON-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.2.1.2.5.1.3.0
      name: panGPGWUtilizationActiveTunnels
      chart_meta:
        description: Number of active tunnels
        family: 'Network/VPN/GlobalProtect/Gateway/Tunnel/Active'
        unit: "{tunnel}"
  - MIB: PAN-ENTITY-EXT-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.1.1.7.1.1.2.0
      name: panEntityTotalPowerUsed
      chart_meta:
        description: Total power used on the system in watts
        family: 'System/Power/Used'
        unit: "W"
  - MIB: PAN-ENTITY-EXT-MIB
    symbol:
      OID: 1.3.6.1.4.1.25461.1.1.7.1.1.1.0
      name: panEntityTotalPowerAvail
      chart_meta:
        description: Total power available on the system in watts
        family: 'System/Power/Available'
        unit: "W"
  - MIB: PAN-ENTITY-EXT-MIB
    table:
      OID: 1.3.6.1.4.1.25461.1.1.7.1.2.1
      name: panEntityFRUModuleTable
    symbols:
      - OID: 1.3.6.1.4.1.25461.1.1.7.1.2.1.1.1
        name: panEntryFRUModulePowerUsed
        chart_meta:
          description: Power used by the FRU Module in watts
          family: 'Hardware/FRU/Module/Power/Used'
          unit: "W"
      - OID: 1.3.6.1.4.1.25461.1.1.7.1.2.1.1.2
        name: panEntryFRUModuleNumPorts
        chart_meta:
          description: Number of ports on the FRU Module
          family: 'Hardware/FRU/Module/Port/Count'
          unit: "{port}"
    metric_tags:
      - tag: FRUmodule_index
        index: 1
      - tag: ent_descr
        MIB: ENTITY-MIB
        symbol:
          OID: 1.3.6.1.2.1.47.1.1.1.1.2
          name: entPhysicalDescr
        table: entPhysicalTable

  - MIB: PAN-ENTITY-EXT-MIB
    table:
      OID: 1.3.6.1.4.1.25461.1.1.7.1.3.1
      name: panEntityFanTrayTable
    symbols:
      - OID: 1.3.6.1.4.1.25461.1.1.7.1.3.1.1.1
        name: panEntryFanTrayPowerUsed
        chart_meta:
          description: Power used by the Fan Tray in watts
          family: 'Hardware/FRU/FanTray/Power/Used'
          unit: "W"
    metric_tags:
      - tag: fan_tray_index
        index: 1
      - MIB: ENTITY-MIB
        symbol:
          OID: 1.3.6.1.2.1.47.1.1.1.1.2
          name: entPhysicalDescr
        table: entPhysicalTable
        tag: ent_descr