CISCO-THREAT-MITIGATION-SERVICE-MIB Table View

Table-centric layout grouping table, row, and column objects.

Standard view Table view

Tables

Rows

Columns

ciTmsThreatTable

table

.1.3.6.1.4.1.9.9.603.1.3.1 · 1 row entry · 9 columns

Open in standard view

This table represents the information about the
threats the consumer has received from various   
controllers belonging to different TIDP groups it is   
registered with.  A threat received from one controller   
in a TIDP group is uniquely identified by the threat id   
and owner id.
          
A row is added to the  table when a threat notification  
message is received by the consumer from the controller in  
a TIDP group. 
A row is deleted from the table when the consumer deletes  
the information about a threat received from a controller 
in a TIDP group.

ciTmsThreatEntry entry .1.3.6.1.4.1.9.9.603.1.3.1.1

Each entry represents a conceptual row in ciTmsThreatTable
and corresponds to the information about a threat and it's
various attributes, received from a controller in a given
TIDP group.

Indexes

ciTmsThreatOwner ciTmsThreatId ciTmsGroupId ciTmsControllerIpType ciTmsControllerIp

Column Syntax OID

ciTmsThreatOwner

This object identifies the controller that has notified the
consumer about the threat.

Unsigned32

Constraints:
range: 1-4294967295

.1.3.6.1.4.1.9.9.603.1.3.1.1.1

ciTmsThreatId

This object represents the identifier for the particular
threat.

Unsigned32

Constraints:
range: 1-65535

.1.3.6.1.4.1.9.9.603.1.3.1.1.2

ciTmsThreatVer

This object represents the version of the
threat.

Unsigned32

Constraints:
range: 0-255

.1.3.6.1.4.1.9.9.603.1.3.1.1.3

ciTmsThreatStatus

This object represents the current status of the threat on
the consumer. This is evaluated locally on consumer.

CTmsThreatStatus

Textual Convention: CTmsThreatStatus Enumeration

Type Values:

1	unknown
2	active
3	inactive
4	created
5	pending
6	activationFailed
7	inactivationFailed
8	deleted

.1.3.6.1.4.1.9.9.603.1.3.1.1.4

ciTmsThreatClass

This object represents the class of threat. An example of
class is 'Worm'.

SNMP-FRAMEWORK-MIBSnmpAdminString

Textual Convention: SNMP-FRAMEWORK-MIBSnmpAdminString OctetString

Type Constraints:
range: 0..255

.1.3.6.1.4.1.9.9.603.1.3.1.1.5

ciTmsThreatName

This object represents name of the threat. An example of
threat name is 'WittyWorm'.

SNMP-FRAMEWORK-MIBSnmpAdminString

Textual Convention: SNMP-FRAMEWORK-MIBSnmpAdminString OctetString

Type Constraints:
range: 0..255

.1.3.6.1.4.1.9.9.603.1.3.1.1.6

ciTmsThreatActiveTimeDuration

This object represents the duration the threat has been
active for.

SNMPv2-TCDateAndTime

Textual Convention: SNMPv2-TCDateAndTime OctetString

Type Constraints:
range: 8
range: 11

.1.3.6.1.4.1.9.9.603.1.3.1.1.7

ciTmsThreatPriority

This object represents the priority at which the consumer
responds to this threat. A higher value indicates a lower
priority for the threat and vice versa.

Unsigned32

Constraints:
range: 1-32

.1.3.6.1.4.1.9.9.603.1.3.1.1.8

ciTmsThreatTcdf

This object represents the TCDF related information received
in the threat. For example,
<tcdf> <match> <eq field='ip.dst_addr' value='10.10.10.1'>
</eq> </match> </tcdf>.

SNMP-FRAMEWORK-MIBSnmpAdminString

Textual Convention: SNMP-FRAMEWORK-MIBSnmpAdminString OctetString

Type Constraints:
range: 0..255

.1.3.6.1.4.1.9.9.603.1.3.1.1.9

ciTmsThreatActionTable

table

.1.3.6.1.4.1.9.9.603.1.3.2 · 1 row entry · 6 columns

Open in standard view

This table represents mitigation action for the respective
threat. A threat is uniquely represented by the threat id,
owner id, controller IP and TIDP group ID and hence 
corresponding objects are used as indices.
A row is added to the table  when the consumer enforces a
mitigation action as a result of receiving a threat message
from a controller in a TIDP group.
A row is deleted from the table when the consumer removes
the mitigation action taken for the threat received from a 
controller in a TIDP group.

ciTmsThreatActionEntry entry .1.3.6.1.4.1.9.9.603.1.3.2.1

Each entry represents a conceptual row in
ciTmsThreatActionTable and corresponds to the
information about the mitigation action
applied for a particular threat.

Indexes

ciTmsThreatOwner ciTmsThreatId ciTmsGroupId ciTmsControllerIpType ciTmsControllerIp ciTmsThreatAction ciTmsThreatActionParamId

Column Syntax OID

ciTmsThreatAction

This object represents the mitigation action taken by
the consumer for a threat.

CTmsActionType

Textual Convention: CTmsActionType Enumeration

Type Values:

1	ignore
2	aclDrop
3	fpmDrop
4	redirect
5	police
6	setIPDscp
7	localException
8	quarantine

.1.3.6.1.4.1.9.9.603.1.3.2.1.1

ciTmsThreatActionParamId

This object identifies an action parameter.

CTmsActionParamIdType

Textual Convention: CTmsActionParamIdType Enumeration

Type Values:

1	noParams
2	cir
3	bir
4	be
5	nexthop
6	dscpVal
7	vlanId

.1.3.6.1.4.1.9.9.603.1.3.2.1.2

ciTmsThreatActionParamType

This object represents the type of an action parameter.

CTmsActionParamType

Textual Convention: CTmsActionParamType Enumeration

Type Values:

1	unsigned
2	networkAddress
3	string

.1.3.6.1.4.1.9.9.603.1.3.2.1.3

ciTmsThreatActionParamLength

This object represents the length of the action parameter
identified by ciTmsThreatActionParamId.

Unsigned32

Constraints:
range: 1-65535

.1.3.6.1.4.1.9.9.603.1.3.2.1.4

ciTmsThreatActionParamValue

This object represents the value of the parameter identified
by ciTmsThreatActionParamId. This value should be interpreted
using type and length of the parameter value represented by
ciTmsThreatActionParamType and ciT…

SNMP-FRAMEWORK-MIBSnmpAdminString

Textual Convention: SNMP-FRAMEWORK-MIBSnmpAdminString OctetString

Type Constraints:
range: 0..255

.1.3.6.1.4.1.9.9.603.1.3.2.1.5

ciTmsThreatActionFailReason

This object specifies the reason for the failure of
a particular threat mitigation action. 'OER mitigation not
supported' is an example of the value populated for this
object. For successfully mitigated threats, this w…

SNMP-FRAMEWORK-MIBSnmpAdminString

Textual Convention: SNMP-FRAMEWORK-MIBSnmpAdminString OctetString

Type Constraints:
range: 0..255

.1.3.6.1.4.1.9.9.603.1.3.2.1.6

ciTmsThreatInterfaceTable

table

.1.3.6.1.4.1.9.9.603.1.3.3 · 1 row entry · 1 columns

Open in standard view

The application of threat mitigation is typically done on one
or more interfaces. This table represents the status of 
mitigation action applied on the respective interfaces.
          
A row is added to the table when the consumer enforces a 
mitigation action on a interface as a result of receiving 
a threat message from a controller in a TIDP group.
A row is deleted from the table when the consumer removes a
mitigation action taken on a interface as a result of threat
received from a controller in a TIDP group.

ciTmsThreatInterfaceEntry entry .1.3.6.1.4.1.9.9.603.1.3.3.1

Each entry represents a row in ciTmsThreatInterfaceTable
and corresponds to the information about the interface on
which the threat mitigation action is applied.

Indexes

ciTmsThreatId ciTmsThreatOwner ciTmsGroupId ciTmsControllerIpType ciTmsControllerIp IF-MIBifIndex

Column Syntax OID

ciThreatInterfaceMitigationApplied

This object indicates whether the mitigation action
for a particular threat has been successfully applied
on an interface or not. A value of 'true' indicates
the successful application of mitigation action, while …

SNMPv2-TCTruthValue

Textual Convention: SNMPv2-TCTruthValue Enumeration

Type Values:

1	true
2	false

.1.3.6.1.4.1.9.9.603.1.3.3.1.1

CISCO-THREAT-MITIGATION-SERVICE-MIB Table View

ciTmsGroupTable

ciTmsThreatTable

ciTmsThreatActionTable

ciTmsThreatInterfaceTable