Trellix IPS allows you to configure an SNMP server to which system audit information is sent from the Manager. You can configure more than one SNMP servers where you want to send audit messages. You can configure the SNMP servers for each admin domain separately. The SNMP server configured for a root admin domain can be different from the SNMP server configured for its child domains. When the Children and the Current checkboxes are selected while configuring an SNMP server for the root admin domain, the SNMP server configured for the child domain will forward notifications to both the parent and child domain SNMP servers. When the Children checkbox is not selected in the root admin domain, then the child domain will use only the SNMP server configured for that domain to forward notifications. The IPS Manager displays the SNMP servers that have been configured. The fields in this page are described within the configuration steps that follow.
For SNMP forwarding, the root domain and parent domains have the option to include audit information from all corresponding child domains.
To configure an SNMP server from your Manager, do the following:
Steps:
Select Manager → <Admin Domain Name> → Setup → Notification → User Activity → SNMP.
The SNMP tab is displayed where Enable SNMP Notification option and the configured SNMP Servers list is displayed.
.png)
Select Yes against Enable SNMP Notification and click Save.
The columns displayed under the SNMP Servers section are as follows:
Field
Description
Profile Name
The profile name from where audit information is sent
IP Address
IP address of the target server
UDP Port
SNMP listening port of the target server
SNMP Version
The version of SNMP server
Audit Forwarding
The logic by which audit information is forwarded to the target server