Customizing the SNMP Trap Output
JSA uses SNMP to send traps that provide information when rule conditions are met.
By default, JSA uses the JSA management information base (MIB) to manage the devices in the communications network. However, you can customize the output of the SNMP traps to adhere to another MIB.
- Use SSH to log in to JSA as the root user.
- Go to the
/opt/qradar/confdirectory and make backup copies of the following files:
- Open the configuration file for editing.
To edit the SNMP parameters for event rules, open the
To edit the SNMP parameters for offense rules, open the
- To change the trap that is used for SNMP trap notification,
update the following text with the appropriate trap object identifier
-<creSNMPTrap version="3" OID="188.8.131.52.4.1.20212.1.1" name="eventCRENotification">
- Use the following table to help you update the variable
Each variable binding associates a particular MIB object instance with its current value.
Table 1: Value Types for Variable Binding
You can configure multiple values.
A numerical value
Each SNMP trap carries an identifier that is assigned to an object within the MIB
A numerical value range
A numerical value that increments within a defined minimum and maximum range
- For each of the value types, include any of the following
Table 2: Fields for the Variable Bindings
For more information about these fields, see the
Custom SNMP trap information that you configured for the custom rules wizard
1Surround the field name with percentage (%) signs. Within the percentage signs, fields must match the value type.
- Save and close the file.
- Copy the file from the
/opt/qradar/confdirectory to the
- Log in to the JSA interface.
- On the navigation menu (), click Admin to open the admin tab.
- Select Advanced >Deploy Full Configuration.
JSA continues to collect events when you deploy the full configuration. When the event collection service must restart, JSA does not restart it automatically. A message displays that gives you the option to cancel the deployment and restart the service at a more convenient time.