-
Notifications
You must be signed in to change notification settings - Fork 1.1k
feat: Add SNMP provider #5324
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
feat: Add SNMP provider #5324
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| --- | ||
| title: "SNMP" | ||
| sidebarTitle: "SNMP Provider" | ||
| description: "SNMP provider allows you to receive SNMP traps from network devices and generate alerts in Keep." | ||
| --- | ||
| import AutoGeneratedSnippet from '/snippets/providers/snmp-snippet-autogenerated.mdx'; | ||
|
|
||
| ## Overview | ||
|
|
||
| The Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. The SNMP provider for Keep allows you to receive SNMP traps from network devices and generate alerts based on these traps. | ||
|
|
||
| ## Inputs | ||
|
|
||
| The SNMP provider receives SNMP trap notifications from network devices. | ||
|
|
||
| ## Outputs | ||
|
|
||
| The SNMP provider generates alerts in Keep with the following information: | ||
| - Alert title (based on trap OID) | ||
| - Alert description (containing trap data details) | ||
| - Alert severity (mapped from trap content or default) | ||
| - Source information | ||
| - Raw trap data | ||
|
|
||
| ## Authentication Parameters | ||
|
|
||
| | Parameter | Required | Description | Default | | ||
| |-----------|----------|-------------|---------| | ||
| | listen_address | No | IP address to listen on for SNMP traps | 0.0.0.0 | | ||
| | port | No | UDP port to listen on for SNMP traps | 162 | | ||
| | community | No | SNMP community string for authentication | public | | ||
| | severity_mapping | No | JSON mapping of OID patterns to Keep severity levels | null | | ||
|
|
||
| ## Connecting with the Provider | ||
|
|
||
| ### Configuration Example | ||
|
|
||
| Add the SNMP provider to your Keep configuration: | ||
|
|
||
| ```yaml | ||
| providers: | ||
| snmp: | ||
| type: snmp | ||
| authentication: | ||
| listen_address: 0.0.0.0 | ||
| port: 1162 | ||
| community: public | ||
| severity_mapping: '{"1.3.6.1.6.3.1.1.5.3": "WARNING", "1.3.6.1.6.3.1.1.5.5": "CRITICAL"}' | ||
| ``` | ||
|
|
||
| ### Setting Up Network Devices | ||
|
|
||
| Configure your network devices to send SNMP traps to the Keep server IP address and port where the SNMP provider is listening. | ||
|
|
||
| Example configuration for a Cisco device: | ||
| ``` | ||
| snmp-server enable traps | ||
| snmp-server host <keep-server-ip> version 2c <community> | ||
| ``` | ||
|
|
||
| ## Testing | ||
|
|
||
| You can test the SNMP provider using tools like `snmptrap` to send test traps: | ||
|
|
||
| ```bash | ||
| snmptrap -v 2c -c public <keep-server-ip>:162 '' 1.3.6.1.6.3.1.1.5.3 1.3.6.1.2.1.2.2.1.1.2 i 2 | ||
| ``` | ||
|
|
||
| For testing with Docker containers, you can use the following configuration: | ||
|
|
||
| ```yaml | ||
| services: | ||
| snmp-agent: | ||
| image: eclipse-mosquitto:latest | ||
| container_name: snmp-agent | ||
| ports: | ||
| - "1883:1883" | ||
| networks: | ||
| - keep_default | ||
|
|
||
| snmp-tools: | ||
| image: debian:bullseye | ||
| container_name: snmp-tools | ||
| command: tail -f /dev/null | ||
| networks: | ||
| - keep_default | ||
| volumes: | ||
| - ./:/data | ||
|
|
||
| networks: | ||
| keep_default: | ||
| external: true | ||
| ``` | ||
|
|
||
| With this setup: | ||
| 1. The `snmp-agent` container runs the Eclipse Mosquitto image which can be used for message brokering | ||
| 2. The `snmp-tools` container provides a Debian environment where you can install and run SNMP tools | ||
| 3. Install SNMP tools in the container with: `docker exec snmp-tools apt-get update && docker exec snmp-tools apt-get install -y snmp snmptrapd` | ||
| 4. Generate test traps from the tools container: `docker exec snmp-tools snmptrap -v 2c -c public keep-api:162 '' 1.3.6.1.6.3.1.1.5.3 1.3.6.1.2.1.2.2.1.1.2 i 2` | ||
|
|
||
| ## Notes | ||
|
|
||
| - The SNMP provider currently supports SNMPv2c only. | ||
| - Port 162 is the standard port for SNMP traps and typically requires elevated privileges to bind. | ||
| - Custom severity mapping allows you to map specific OIDs to alert severity levels. | ||
|
|
||
| ## Troubleshooting | ||
|
|
||
| - **No traps received**: Ensure port 162 is accessible and not blocked by firewalls. | ||
| - **Permission issues**: Binding to port 162 typically requires elevated privileges. Consider using a higher port (>1024) for testing. | ||
| - **Mapping issues**: Check the syntax of your severity_mapping JSON string. | ||
|
|
||
| ## Useful Links | ||
|
|
||
| - [SNMP RFC 3411](https://tools.ietf.org/html/rfc3411) - SNMP Architecture | ||
| - [Net-SNMP Documentation](http://www.net-snmp.org/docs/) | ||
|
|
||
| <AutoGeneratedSnippet /> | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| {/* This snippet is automatically generated using scripts/docs_render_provider_snippets.py | ||
| Do not edit it manually, as it will be overwritten */} | ||
|
|
||
| ## Authentication | ||
| This provider requires authentication. | ||
| - **listen_address**: IP address to listen on for SNMP traps (required: False, sensitive: False) | ||
| - **port**: UDP port to listen on for SNMP traps (required: False, sensitive: False) | ||
| - **community**: SNMP community string for authentication (required: False, sensitive: True) | ||
| - **severity_mapping**: JSON mapping of OID patterns to Keep severity levels (required: False, sensitive: False) | ||
|
|
||
| Certain scopes may be required to perform specific actions or queries via the provider. Below is a summary of relevant scopes and their use cases: | ||
| - **receive_traps**: Receive and process SNMP traps (mandatory) | ||
|
|
||
|
|
||
|
|
||
| ## In workflows | ||
|
|
||
| This provider can be used in workflows. | ||
|
|
||
|
|
||
| As "step" to query data, example: | ||
| ```yaml | ||
| steps: | ||
| - name: Query snmp | ||
| provider: snmp | ||
| config: "{{ provider.my_provider_name }}" | ||
|
|
||
|
|
||
| ``` | ||
|
|
||
|
|
||
| As "action" to make changes or update data, example: | ||
| ```yaml | ||
| actions: | ||
| - name: Query snmp | ||
| provider: snmp | ||
| config: "{{ provider.my_provider_name }}" | ||
|
|
||
|
|
||
| ``` | ||
|
Comment on lines
+21
to
+40
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Snippet implies query/action usage, but provider is consumer-only. Unit tests show I can patch the docs snippet generator to detect 🤖 Prompt for AI Agents |
||
|
|
||
|
|
||
|
|
||
| If you need workflow examples with this provider, please raise a [GitHub issue](https://github.com/keephq/keep/issues). | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Replace MQTT container with proper SNMP tooling; simplify test setup.
Eclipse Mosquitto is MQTT, not SNMP. Recommend a single tools container to send traps to Keep.
Optional: advise using an unprivileged port (e.g., 1162) in examples to avoid root binds.
Also applies to: 95-100