Skip to content

Conversation

@onyedikachi-david
Copy link

@onyedikachi-david onyedikachi-david commented Apr 12, 2025

Closes #2112
/claim #2112
image
image

📑 Description

This PR adds a new SNMP provider to Keep that enables receiving SNMP traps as alerts. The implementation includes:

  • Full SNMP provider implementation with support for v1, v2c, and v3 protocols
  • SNMP trap receiver that converts traps to Keep alerts
  • Configurable trap port (default: 1162)
  • Proper error handling and logging
  • Automatic severity mapping from trap data
  • Support for both IPv4 and IPv6 trap reception
  • Comprehensive configuration validation
  • Provider scopes:
    • Read (mandatory): For reading SNMP data from agents
    • Write (optional): For setting SNMP values on agents
    • Trap (optional): For receiving SNMP traps

✅ Checks

  • My pull request adheres to the code style of this project
  • My code requires changes to the documentation
  • All the tests have passed

ℹ Additional Information

Configuration

The SNMP provider supports the following authentication configurations:

  • For v1/v2c:

    • Host
    • Version (v1/v2c)
    • Community string
    • Port (default: 161)
    • Trap port (default: 1162)
  • For v3:

    • Host
    • Version (v3)
    • Username
    • Authentication protocol (MD5/SHA)
    • Authentication key
    • Privacy protocol (DES/AES)
    • Privacy key
    • Security level (noAuthNoPriv/authNoPriv/authPriv)
    • Port (default: 161)
    • Trap port (default: 1162)

Alert Generation

SNMP traps are converted to Keep alerts with:

  • Automatic severity mapping based on trap data
  • Source tracking from agent address
  • Detailed trap information in alert description

Testing

The implementation includes tests for:

  • Configuration validation
  • Error handling scenarios

Breaking Changes

None. This is a new provider that doesn't affect existing functionality.

@vercel
Copy link

vercel bot commented Apr 12, 2025

@onyedikachi-david is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

@dosubot dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. Feature A new feature Provider Providers related issues labels Apr 12, 2025
Copy link
Member

@shahargl shahargl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @onyedikachi-david, thanks for this.

This looks like a great start.

However - few issues before I can start reviewing:

  1. I need some docker-compose or instructions to set SNMP server (?) that sends traps so I can debug it
  2. The consumer provider already runs in a separate thread - why did you created another one?
  3. No documentation

@talboren
Copy link
Member

@shahargl @onyedikachi-david i'm closing this one for now as it seems to be stale and @onyedikachi-david haven't answered for a while. If you think this is a mistake, please re-open the issue.

@talboren talboren closed this Apr 28, 2025
@00041275
Copy link
Contributor

00041275 commented May 7, 2025

@onyedikachi-david please edit /keep/keep/api/routes/alerts.py for take another data which diff at POST for /event/{provider_type} with another protocol (in your case UDP) and processing data with provider function parse_event_raw_body()

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🙋 Bounty claim Feature A new feature Provider Providers related issues size:XL This PR changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🔌 Provider]: SNMP provider

4 participants