One Hat Cyber Team

View File Name : sophos-xgs-firewall.yaml

extends:
  - _system-base.yaml
  - _std-host-resources-mib-feat-base.yaml
  - _std-if-mib.yaml

selector:
  - sysobjectid:
      include:
        - 1.3.6.1.4.1.2604.5

metadata:
  device:
    fields:
      vendor:
        value: "Sophos"
      type:
        value: "Firewall"

metric_tags:
  - tag: sfos_device_type
    OID: 1.3.6.1.4.1.2604.5.1.1.2.0
    symbol: sfosDeviceType
  - tag: sfos_device_fw_version
    OID: 1.3.6.1.4.1.2604.5.1.1.3.0
    symbol: sfosDeviceFWVersion
  - tag: sfos_ips_version
    OID: 1.3.6.1.4.1.2604.5.1.1.6.0
    symbol: sfosIPSVersion

# SFOS-FIREWALL-MIB
# https://mibbrowser.online/mibdb_search.php?mib=SFOS-FIREWALL-MIB
# https://github.com/DanielleHuisman/observium-community-edition/blob/main/mibs/sophos/SFOS-FIREWALL-MIB

metrics:
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: memory.usage
      OID: 1.3.6.1.4.1.2604.5.1.2.5.2.0
      chart_meta:
        description: "Percentage usage of main memory"
        family: 'System/Memory/Usage'
        unit: "%"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: memory.total
      OID: 1.3.6.1.4.1.2604.5.1.2.5.1.0
      scale_factor: 1048576
      chart_meta:
        description: "Memory capacity in MB"
        family: 'System/Memory/Total'
        unit: "By"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosDiskCapacity
      OID: 1.3.6.1.4.1.2604.5.1.2.4.1.0
      scale_factor: 1048576
      chart_meta:
        description: "Disk capacity in MB"
        family: 'System/Disk/Total'
        unit: "By"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosDiskPercentUsage
      OID: 1.3.6.1.4.1.2604.5.1.2.4.2.0
      chart_meta:
        description: "% Disk usage"
        family: 'System/Disk/Usage'
        unit: "%"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosSwapCapacity
      OID: 1.3.6.1.4.1.2604.5.1.2.5.3.0
      chart_meta:
        description: "Swap Capacity in MB"
        family: 'System/Memory/Swap/Total'
        unit: "MBy"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosSwapPercentUsage
      OID: 1.3.6.1.4.1.2604.5.1.2.5.4.0
      chart_meta:
        description: "% usage of swap"
        family: 'System/Memory/Swap/Usage'
        unit: "%"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosLiveUsersCount
      OID: 1.3.6.1.4.1.2604.5.1.2.6.0
      chart_meta:
        description: "Display live user count login into captive portal"
        family: 'System/User/Portal/Active'
        unit: "{session}"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosHTTPHits
      OID: 1.3.6.1.4.1.2604.5.1.2.7.0
      chart_meta:
        description: "Number of HTTP hits"
        family: 'Network/Protocol/HTTP/Request/Total'
        unit: "{request}/s"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosFTPHits
      OID: 1.3.6.1.4.1.2604.5.1.2.8.0
      chart_meta:
        description: "Number of FTP hits"
        family: 'Network/Protocol/FTP/Request/Total'
        unit: "{request}/s"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosPOP3Hits
      OID: 1.3.6.1.4.1.2604.5.1.2.9.1.0
      chart_meta:
        description: "Number of POP3 hits"
        family: 'Network/Protocol/POP3/Request/Total'
        unit: "{request}/s"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosImapHits
      OID: 1.3.6.1.4.1.2604.5.1.2.9.2.0
      chart_meta:
        description: "Number of IMAP hits"
        family: 'Network/Protocol/IMAP/Request/Total'
        unit: "{request}/s"
  - MIB: SFOS-FIREWALL-MIB
    symbol:
      name: sfosSmtpHits
      OID: 1.3.6.1.4.1.2604.5.1.2.9.3.0
      chart_meta:
        description: "Number of SMTP hits"
        family: 'Network/Protocol/SMTP/Request/Total'
        unit: "{request}/s"
  - MIB: SFOS-FIREWALL-MIB
    table:
      name: sfosIPSecVpnTunnelTable
      OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1
    symbols:
      - name: sfosIPSecVpnActiveTunnel
        OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1.1.8
        chart_meta:
          description: "Count of active tunnel"
          family: 'Network/VPN/IPSec/Tunnel/Active'
          unit: "{tunnel}"
    metric_tags:
      - tag: sfos_ip_sec_vpn_conn_index
        index: 1
      - tag: sfos_ip_sec_vpn_conn_name
        symbol:
          name: sfosIPSecVpnConnName
          OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1.1.2
      - tag: _sfos_ip_sec_vpn_conn_des
        symbol:
          name: sfosIPSecVpnConnDes
          OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1.1.3
      - tag: _sfos_ip_sec_vpn_policy_name
        symbol:
          name: sfosIPSecVpnPolicyName
          OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1.1.4
      - tag: _sfos_ip_sec_vpn_conn_mode
        symbol:
          name: sfosIPSecVpnConnMode
          OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1.1.5
      - tag: _sfos_ip_sec_vpn_conn_type
        symbol:
          OID: 1.3.6.1.4.1.2604.5.1.6.1.1.1.1.6
          name: sfosIPSecVpnConnType
        mapping:
          1: host-to-host
          2: site-to-site