CSAMC-SNMPv2-MIB DEFINITIONS ::= BEGIN

IMPORTS
    enterprises, Counter
             FROM RFC1155-SMI
    OBJECT-TYPE
             FROM RFC-1212
    TRAP-TYPE
             FROM RFC-1215;

--
-- Assigned by IANA
--

ciscoSecurityAgent    OBJECT IDENTIFIER ::= { enterprises 8590 }

--
-- Cisco Security Agent subtrees
--

csaModules OBJECT IDENTIFIER ::= { ciscoSecurityAgent 1 }
csaObjects OBJECT IDENTIFIER ::= { ciscoSecurityAgent 2 }
csaTraps   OBJECT IDENTIFIER ::= { ciscoSecurityAgent 3 }

--
-- Managed objects follow
--
-- Contents:
--     csaNotifyMessage      Alert generated by Cisco Security Agent
--


eventID OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS  not-accessible
        STATUS  mandatory
        DESCRIPTION "An integer uniquely identifying the event."

        ::= {csaObjects 1}

ruleID OBJECT-TYPE
       SYNTAX  INTEGER
       ACCESS  not-accessible
       STATUS  optional
       DESCRIPTION "An integer uniquely identifying the rule that caused the event."

       ::= {csaObjects 2}

hostName OBJECT-TYPE
       SYNTAX  OCTET STRING
       ACCESS  not-accessible
       STATUS  optional
       DESCRIPTION "Name of the host that generated the event."

       ::= {csaObjects 3}

eventTime OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  mandatory
        DESCRIPTION "The time at which the event occurred."

        ::= {csaObjects 4}

severityCode OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "An integer indicating event severity, from Information (1) to
          Emergency (7)."

        ::= {csaObjects 5}

eventCode OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS  not-accessible
        STATUS  mandatory
        DESCRIPTION "An integer uniquely identifying event type."

        ::= {csaObjects 6}

processName OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "When applicable, the process that triggered the event."

        ::= {csaObjects 7}

fileName OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "When applicable, the name of the relevant file from
          a file event."

        ::= {csaObjects 8}

sourceIPAddress OBJECT-TYPE
        SYNTAX  IpAddress
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "When applicable, the source IP address of a network event."

        ::= {csaObjects 9}

destinationIPAddress OBJECT-TYPE
        SYNTAX  IpAddress
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "When applicable, the destination IP address of a network event."

        ::= {csaObjects 10}

eventText OBJECT-TYPE
    SYNTAX       OCTET STRING
    ACCESS       not-accessible
    STATUS       mandatory
    DESCRIPTION  "The complete formatted text of the event."

    ::= { csaObjects 11 }

hostID OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS not-accessible
        STATUS optional
        DESCRIPTION "An integer uniquely identifying the host that generated the
          event."

        ::= { csaObjects 12 }

currentHostIPAddress OBJECT-TYPE
               SYNTAX  IpAddress
               ACCESS not-accessible
               STATUS optional
               DESCRIPTION "The most recently recorded IP address of the host that
                 generated the event."

        ::= { csaObjects 13 }

hostOSType OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "The OS type of the host that generated the event, W for Windows,
          U for Unix"

        ::= { csaObjects 14 }

sourcePort OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS not-accessible
        STATUS optional
        DESCRIPTION "When applicable, the port used by the source of a network event."

        ::= { csaObjects 15 }

destinationPort OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS not-accessible
        STATUS optional
        DESCRIPTION "When applicable, the port used by the destination of a network
          event."

        ::= { csaObjects 16 }

eventType OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "A string representing the type of the rule that caused the event."

        ::= { csaObjects 17 }

ruleDescription OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "The user-specified string description of the rule that caused
          the event."

        ::= { csaObjects 18 }

policyID OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS not-accessible
        STATUS optional
        DESCRIPTION "An integer uniquely identifying the policy which contains the
          rule that caused the event."

        ::= { csaObjects 19 }

policyName OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "The string name of the policy which contains the rule that
          caused the event."

        ::= { csaObjects 20 }

buttonCode OBJECT-TYPE
        SYNTAX  INTEGER
        ACCESS not-accessible
        STATUS optional
        DESCRIPTION "When applicable, the bottom 16 bits represent the query button
          that the user pressed."

        ::= { csaObjects 21 }

userName OBJECT-TYPE
        SYNTAX  OCTET STRING
        ACCESS  not-accessible
        STATUS  optional
        DESCRIPTION "The name of the logged-in user at the time of the event."

        ::= { csaObjects 22 }
--
-- Traps follow
--
-- Contents:
--     csaNotifyTrap         Trap containing a single csaNotifyMessage
--


csaNotifyTrap TRAP-TYPE
    ENTERPRISE   csaTraps
    VARIABLES    {         eventID, ruleID, hostName, eventTime,
                              severityCode, eventCode, processName, fileName,
                              sourceIPAddress, destinationIPAddress2, eventText,
                              hostID, currentHostIPAddress, hostOSType,
                              sourcePort, destinationPort,
                              eventType, ruleDescription, policyID, policyName,
                              buttonCode, userName }
    DESCRIPTION  "An alert generated by a Cisco Security Manager."

    ::= 1

END