SNMP trap events and object definitions

Definition: Use this object to identify the unique event ID (GUID).

ℹ️

This object uses sub-identifier 0 under eEyeEvent, which is non-standard in SMIv1 (sub-identifiers typically start at 1). The SNMP formatter does not include a varbind for this field, and the eEyeEventAlert VARIABLES list excludes it.

BeyondTrust Discovery scan events

Application audit events

Endpoint Privilege Management for Windows / Endpoint Privilege Management for Mac events

Password Safe events

Privilege Management Reporting events

Appliance Health events

Definition: Use this object to identify the agent that sent the event.

Valid values

Definition: Use this object to identify the version of the agent that sent the event.

ℹ️

You can find this object and its OID in the MIB, and the Event populates the value. The SNMP formatter does not currently emit a varbind for this field, and the eEyeEventAlert VARIABLES list excludes it.

Valid values

Definition: Use this field to identify the event category. The value varies by event source:

• EPM for Windows / EPM for Mac events: always "pbw"
• Password Safe events: "System", "Change", or "Propagation"
• Privilege Management Reporting events: "Service Starts", "User Logons", "Privileged Account Protection", "Processes"
• Appliance Health events: always "UVMHealth" regardless of sub-type
• BeyondTrust Discovery scan events: the scan engine sets this value; no fixed enumeration exists. For vulnerability findings (deprecated) it contains the vulnerability category (e.g., "Web", "OS", "Database"). For infrastructure/OS detection events, known values include: "OSDETECT", "OSDETECT\Method", "OSDETECT\CpeString", "Traceroute", "Authentication", "AssetType", "OriginalDNSName"
• Application audit events: the system or section that generates the event

Application audit category values

Definition: For Appliance Health UVM-GENERAL-001 (GeneralAlert) events, use this field to identify the specific condition, since all general events share the same ID. Known conditions include authentication access successes and failures, boot/shutdown events (clean vs. unexpected), and anti-malware notifications.

Definition: Use this object to identify the event severity, 0–9 from lowest to highest.

Definition: Use this object to identify the event subject. Valid values are the following:

• Target IP
• Job Name
• Job ID

Definition: Use this object to identify the event name. The value varies by event source:

• EPM for Windows / EPM for Mac events: the numeric EventTypeId - "28691", "28692", "28693", "28694", "28695", "28696", "28697", "28698", "28699", "28701", "28702", "28703"
• Password Safe - System events: the role used for the access request. Known values: "Requestor", "Approver", "Requestor/Approver", "ISA", "Administrators", "Built-in Admin", "Session Auditor", "Credentials Manager", "Recorded Session Reviewer", "Active Session Reviewer", "Reports Auditor", "SystemManagement", "AccountManagement", "ConfigurationManagement", "PolicyManagement", "AgentManagement", "DomainManagement", "RoleManagement", "BulkPasswordChange", "AdminSession", "AdminSessionReviewer", "AssetManagement", "APIGlobalQuarantine", "PBW RunAsEvent", "Administrator", "Non-Requestor", "N/A"
• Password Safe - Change events: "Managed" (managed account), "Functional" (functional account), or "Change" (fallback)
• Password Safe - Propagation events: "Propagation"
• Privilege Management Reporting events: "400" (Service Starts), "300" (User Logons), "198" (Privileged Account Protection); Processes events use a dynamic event number read from the database
• Appliance health events:
  • "ServiceErrorAlert" (UVM-SERVICE-*)
  • "PerformanceAlert" (UVM-PERF-*)
  • "HardwareFaultAlert" (UVM-HARDWARE-*)
  • "AntiMalwareAlert" (UVM-ANTIMALWARE-*)
  • "DailyPerformanceSummary" (UVM-PERFDAILY-*)
  • "GeneralAlert" (UVM-GENERAL-*)
• BeyondTrust Discovery scan events: set by the scan engine; not a fixed enumeration. For vulnerability findings (deprecated) it contains the specific audit or check name (e.g., a CVE or MS bulletin ID). For scan summary and metadata events, known values include: "Total hosts scanned", "Total hosts found", "Audit Group", "Address Group", "Credential", "IP Entry", "OS Detected", "Traceroute", "Netbios Name", "Method", "REM NAV", "Virtual Machine Name", "Virtual Machine UUID"
• Application audit events: the action performed. Known values: "Login", "Logout", "Add", "Edit", "Delete", "Read", "Enable", "Disable", "Increase Priority", "Decrease Priority", "Assign", "Rename", "Save As", "Schedule", "Pause Job", "Resume Job", "Stop Job", "Delete Job", "Reset", "Import", "Copy", "Generate", "Validate", "Test", "Update", "Unlock", "Download", "Completed", "Session End", "Add Vulnerability Exclusion" (deprecated), "Remove Vulnerability Exclusion" (deprecated), "Ignore", "Remove from Ignored", "Download Policy JSON", "Bulk Password Change", "Bulk Domain Account Unlink", "Bulk Move Credential", "Bulk Add Credential", "Bulk Read", "Read Password", "ReadSecret", "Move Folder", "Share Secret", "Delete Secret Share", "Delete Secret Shares", "Edit Secret Share", "Lock Session", "Terminate Session", "Default"

Definition: Use this object to identify the number of extra name-value pairs.

Definition: Use this object to identify the table that contains extra information. Every extra item is a name-value pair.

Definition: Use this object to identify one name-value pair, indexed by eEyeEventNVName.

Definition: Use this object to identify the name part of the event name-value pair.

NVP keys by event source

Password Safe-System events

Password Safe-Change events

Password Safe-Propagation events

Same keys as Change events, plus per-action result entries for each propagation target (action type, result, target name, username).

Definition: Use this object to identify the value part of the event name-value pair.

Definition: Use this object to identify the event source IP.

Definition: Use this object to identify the operating system.

Description: Use this object to identify the workgroup location.

Definition: Use this object to identify the workgroup ID.

Definition: Use this object to identify the workgroup description.

Definition: Use this object to identify the client hostname.

**Definition:**Use this object to identify the user name. Valid value: System.

Definition: Use this object to identify the event date.

Definition: Use this object to identify the transaction group.

Definition: Use this object to identify the subject description. The meaning of this field varies by event source (for example: target computer name for scan events, account name for Password Safe events, user identifier for Application Audit events).

ℹ️

The MIB defines this object and its OID, but the SNMP formatter does not currently emit a varbind for this field. The eEyeEventAlert VARIABLES list excludes it.

Definition: Use this object to identify the agent ID.

Valid values

Definition: Use this object to identify the DLL version.

Use this single trap type to monitor BeyondInsight security event notifications, regardless of event source.

Trap OID behavior

• SNMPv1: The formatter does not explicitly set the enterprise OID and specific-trap field. Do not rely on the specific-trap value matching ::= 2.
• SNMPv2c/v3: The formatter sets TrapObjectID (snmpTrapOID.0) to the configured trapOid, which defaults to 1.3.6.1.4.1.20730.1. This does not follow the RFC 2576 translation rule that would derive 1.3.6.1.4.1.20730.1.0.2 from the ::= 2 assignment. Match on 1.3.6.1.4.1.20730.1 rather than on the TRAP-TYPE-derived OID.

To identify the event source, examine the eEyeEventAgentID varbind (e.g., 'retina', 'PBPS', 'pbw', 'pbmac', 'AppAudit', 'pmr', 'generic_appliance_health'). To identify the event type within a source, examine the eEyeEventID varbind.

Variables (varbinds included in every trap)

ℹ️

The MIB defines eEyeEventUniqueID(OID.0), eEyeEventAgentVersion(OID.3), and eEyeEventSubjectDesc(OID.21`), but the VARIABLES list above excludes them. The SNMP formatter does not currently emit varbinds for these fields.