Creating Tickets In FortiSIEM In-built Ticketing System

AccelOps includes a feature that will let you create and assign tickets for IT infrastructure tasks, and create tickets directly from incidents. You can see all tickets that have been created by going to Incidents > Tickets, and then use the filter controls to view tickets by assignee, organization, priority, and other attributes. You can also configure AccelOps and you Remedy system so that Remedy will take tickets created by incident notification actions.

Configuring Remedy to Accept Tickets from AccelOps Incident Notifications Ticket Related Operations

Configuring Remedy to Accept Tickets from AccelOps Incident Notifications

This topic describes how to configure Remedy to accept tickets as notification actions from AccelOps.

Prerequisites

Procedure

Incident Attributes for Defining Remedy Forms

Prerequisites

Make sure you have configured the Remedy server settings in AccelOps.

Procedure

• In Remedy, create a new form, AccelOps_Incident_Interface, with the incident attributes listed in the table at the end of this topic as the form fields.

2. When you have defined the fields in the form, right-click on the field and select the Data Type that corresponds to the incident attribute.
3. After setting the form field data type, click in the form field again to set the Label for the field.
4. When you are done creating the form, go to Servers > localhost > Web Service in Remedy, and select New Web Service.
5. For Base Form, enter AccelOps_Incident_Interface.
6. Click the WSDL
7. For the WSDL Handler URL, enter http://<midtier_server>/arsys/WSDL/public/<servername>/AccelOps_Incident_I nterface.
8. Click the Permissions tab and select
9. Click

You can test the configuration by opening a browser window and entering the WSDL handler URL from step 7, substituting the Remedy Server IP address for <midtier_server> and localhost for <servername>. If you see an XML page, your configuration was successful.

Incident Attributes for Defining Remedy Forms

Ticket Related Operations

Creating a ticket without an Incident

1. Go to Incidents > Tickets.
2. Click New.
3. Enter a Summary and Description for the ticket. Both of these fields are required.
4. For Assigned To, select a user from the menu.
5. Set any Due Date for the ticket.
6. Select a Priority for the ticket.
7. Click Save.

Creating a ticket from an Incident

1. In the Incident Dashboard, select the incident you want to create a ticket for.
2. Click Ticket.

The Incident ID, Summary and Description for the ticket will be populated from the incident information.

3. Select the person you want to assign the ticket to.
4. Enter a Due Date for the ticket.
5. Set a Priority for the ticket.
6. Click Save.

Closing a ticket

1. Go to Incidents > Tickets.
2. Select a ticket
3. Click Edit
4. For State drop down, select Closed
5. Click

Changing the assignee in a ticket

1. Go to Incidents > Tickets.
2. Select a ticket
3. Click Edit
4. For Assigned drop down, select the new Assignee
5. Click

Changing the due date in a ticket

1. Go to Incidents > Tickets.
2. Select a ticket
3. Click Edit
4. For Due Date edit box, select the date and then the time Click Save.

Adding notes to a ticket

1. Go to Incidents > Tickets.
2. Select a ticket
3. Click Edit
4. Add to Description
5. Click Save

Adding attachments to a ticket

1. Go to Incidents > Tickets.
2. Select a ticket
3. Click Edit
4. Click PDF or PNG under Attach file
5. Include the file and Click Upload.
6. Click Save

Exporting a ticket

1. Go to Incidents > Tickets. 2. Select a ticket
2. Click Export

Viewing Ticket History

1. Go to Incidents > Tickets.
2. Select a ticket
3. Click Edit
4. See Action History on bottom right pane

Searching tickets

This can be done in two ways

Type in key words in Search box

Use the Attribute Value Search –

Creating Tickets in External Ticketing System

See External Helpdesk System Integration.

Using Incidents in Searches and Rules

Creating an Historical Search from an Incident

Creating a Real Time Search from an Incident Editing Rules from Incidents

Creating an Historical Search from an Incident

When you are viewing an incident, you may want to about other events related to the source or target of the incident. This topic describes how to create an historical search from an incident.

1. In the Incident Dashboard, select the incident you want to use.
2. Select the Incident Source or Incident Target you want to use, and then select Show Related Historical Events.

The Historical Search interface will load, with the IP address of the selected incident attribute loaded in the Filter By conditions, and the Display Fields set to the incident attributes.

3. Click Run.
4. You will see a list of events for the Incident Source or Target, which you can further analyze as described in Refining the Results from Historical Search.

Creating a Real Time Search from an Incident

When you are viewing an incident, you may want to about other events related to the source or target of the incident. This topic describes how to create a real time search from an incident.

1. In the Incident Dashboard, select the incident you want to use.
2. Select the Incident Source or Incident Target you want to use, and then select Show Related Real Time Events.

The real time search interface will load, with the IP address of the selected incident attribute loaded in the Filter By conditions, and the Di splay Fields set to the incident attributes.

3. Click Run.
4. You will see a list of events for the Incident Source or Target, which you can further analyze as described in Viewing and Refining Real Time Search Results.

Editing Rules from Incidents

If you need to edit the rule associated with an incident, you can do so directly from the Incident Dashboard.

1. In the Incident Dashboard, select an incident based on the rule you want to edit.
2. Click in any column of the selected incident to open the Options menu, and then select Edit Rule.
3. Edit the rule as necessary, and then click Save.

Wanted everyone to know that I am still alive and well. Been moving and getting situated at the new location and just haven’t stayed disciplined enough over the past two months or so to when it comes to making video content.

Anyways, more videos should be incoming and if you have any suggestions please don’t hesitate to let me know.

I am also half tempted to start doing podcasts. Never done one but I am sure I could figure something out there.

Incidents – HTML5 version

Incident tab allows users to view and manage incidents.

Incident Attributes

This topic describes all the columns that can be used to create views in the Incident Dashboard. You can add or remove columns from the dashboard by clicking the Columns icon.

Viewing Incidents

Device Risk View of all incidents

List view of all incidents

Viewing incident details

Grouped View of all incidents

Device Risk View of all incidents

This is the default view when user clicks the Incident tab. It shows a list of devices that triggered incidents. Devices are ranked by a risk score that is computed by combining asset criticality, triggered incidents and found security vulnerabilities (details – here).

To see the incidents for a device, click that device. The incidents show up in a time line view.

List view of all incidents

This view provides a list of all incidents over a time period. By default:

Active Incidents over the last 2 hours are displayed

The following incident attributes are shown

Severity – High, Medium, Low – shown by colored icons

Last Occurred – the last time the Incident happened

Reporting Device Name – names of devices that reported the events that led to the incident Incident – rule name

Source – incident source

Target – incident target

Detail – incident parameters other than source and target

Count – number of times the same incident has triggered

To show incidents over a different time interval

Click Time Range Button

A search window appears

To choose a relative time window

Choose Time Range Operator as LAST.

Specify the number of Minutes/Hours/Days/Weeks.

Click Check button.

The Incident page will automatically refresh to show all the incidents over the time window.

To choose an absolute time window

Choose Time Range Operator as FROM.

Specify the starting and end times.

Click Check button.

The Incident page will automatically refresh to show all the incidents over the time window

An incident can be in any of the following states

Active

Cleared

Cleared Manually

System Cleared

By default only Active Incidents are shown. To show Incidents in other states

Click Incident Status Button  A search window appears

To add a new value, click on the white space next to the selected value. A menu appears. Select the needed values one by one.

Click Check button

The Incident page will automatically refresh to show all the incidents in selected state(s)

To select a different set of Incident attributes

Click Choose columns icon

In the popup, select the columns you want to display by moving them to the right. You can re-order the position of the columns. ClickOK.To force a refresh of the incident view, click the Refresh icon

Incidents may be displayed over multiple pages. To see incidents on a different page,

Select the Page Selector icon

Either enter the page number or click on the Next or Previous icon to go to the right page

To view incidents for a different organization (Service Provider version),

Click the User icon on top right

Choose the right organization

Click Change View

Viewing incident details

In the default view, an incident is shown in a single line. To see the details of the incident,

Click anywhere on the incident line

Basic incident attributes are shown immediately below the incident More advanced incident attributes are shown in a bottom pane

To revert to the single line incident view, click anywhere on the incident line. Detailed views will disappear.

To view the rule that triggered the incident,

Click anywhere on the incident line in the single line incident view In the bottom pane, Click Rule tab. Rule details are displayed.

To view the events that triggered the incident

Click anywhere on the incident line in the single line incident view

In the bottom pane, Click Events tab. Basic Event attributes are displayed in a single line. To see the raw events, click on the Basic Event line. Raw events are displayed.

Grouped View of all incidents

Sometimes user may need a grouped view of incidents to get an overview of what incidents have triggered and involves which devices. The following grouped views are provided

Severity – Ranks Incident Severities By Count

Name – Ranks the Incidents By Count

Name, Target – Ranks Incident Name and Incident Target By Count

Name, Source – Ranks Incident Name and Incident Source By Count

Name, Source, Target – Ranks Incident Name, Incident Source and Incident Target By Count

Name, Source, Target, Business Service – Ranks Incident Name, Incident Source, Incident Target and Business Services By Count Name, Source, Target, Business Service, Organizations – Ranks Incident Name, Incident Source, Incident Target, Business Services and Organizations By Count

Searching Incidents

Searchable Incident Attributes

Constructing Search Condition

Searchable Incident Attributes

Constructing Search Condition

To construct a Search condition from a displayed Incident,

Mouse over the cell containing the specific Incident attribute

Right click and choose Add to filter

The condition will be added to existing search string

Matching incidents will be displayed

To construct a Search condition from scratch

Click on the Add filter edit area. Three fields are displayed

Incident Attribute

Operator

Value

Select one of the Incident Attributes from the drop down

Select an Operator from =, != IN, NOT IN, CONTAINS, NOT CONTAINS Select one or more Values from the displayed choices Click the Check button.

Matching incidents will be displayed

Managing Incidents

Adding Comments

Clearing Incidents

Exporting Incidents to a PDF document

Adding Comments

Click on an Incident in the un-grouped view From Actions drop down, select Add Comments Write the comment and click OK.

Clearing Incidents

Click on an Incident in the un-grouped view

If you have more incidents to clear, then press Shift and click on the second incident. This will will select all incidents between the first one and this one. To get this approach to work effectively,

Create a filter to get all the incidents to be cleared in view

Select the first incident

Press Shift and click on the last incident – all incidents are now selected From Actions drop down, select Clear Click OK

Exporting Incidents to a PDF document

Click on an Incident in the un-grouped view

If you have more incidents to export, then press Shift and click on the second incident. This will will select all incidents between the first one and this one. To get this approach to work effectively,

Create a filter to get all the incidents to be exported in view

Select the first incident

Press Shift and click on the last incident – all incidents are now selected From Actions drop down, select Export Click OK

Device Risk Score Computation

Risk computation algorithms are proprietary and this section presents only the knobs that user is able to tweak to change the score.

Risk score components

The following factors affect risk score of a device

1. Device Importance (also called Asset Weight)
2. Count and CVS Score for non-remediated vulnerabilities found for that device
3. Severity and Frequency of Security incidents triggering with that device as source or destination
4. Severity and Frequency of Other (performance, availability and change) incidents triggering on that device

Overall Score (0-100) is a weighted average of 3 components – Vulnerability Score, Security Incident Score and Other Incident Score, computed as follows.

User controllable constants

1. Device Importance – this can be set in CMDB > Device > Summary. You can select multiple devices and set the Importance in one shot.

Values are

1. Mission Critical – 10
2. Critical – 7
3. Important – 4
4. Normal – 1

2. Relative weights of Vulnerabilities, Security and Other incidents to the risk score. The default values of the constants are defined in phoenix_config.txt:
   1. vul_weight = 0.6
   2. security_inci_weight = 0.3
   3. security_inci_weight = 0.1
3. Maximum number of high-severity events that a mission-critical host can tolerate for each of the 3 score components. These default thresholds are defined in ‘phoenix_config.txt:
   1. vul_threshold = 1
   2. security_inci_threshold = 3
   3. other_inci_threshold = 6

Time varying Risk score

Risk scores are computed for each day. Current risk score is a exponentially weighted average of today’s risk and yesterday’s risk.

The algorithm also reduces the score for earlier vulnerabilities that are now patched. Such vulnerabilities have a weight of 0.7 while new and old but existing vulnerabilities have weight 1

Miscellaneous Operations

Exporting Events to Files

You can run the phExportEvent tool from a Supervisor or Worker node to export events to CSV files. The file will contain these fields:

Dynamic Population of Location, User, and and Geolocation Information for Events

In most cases, network logs only contain IP address information, but to investigate incidents involving that IP, you need additional context for that IP address such as host name, user, and geolocation information. Because FortiSIEM collects detailed IT infrastructure information in the CMDB, it is able to correlate that information to the IP address to create a context for the event, and insert that context information into events in real time as parsed attributes. This topic describes the way in which this context information is populated into events.

Correlating Event Information

Assigning Attributes to Events

Host Name Attribute

User Name Attribute

Geolocation Attribute

Dynamic Updating of Attribute Information

Attributes Added to Events

Correlating Event Information

Event information is derived from several different sources.

1. During the discovery process, FortiSIEM discovers the host name and network interface address information during discovery and stores them in the CMDB. If any IP address other than the Access IP changes, then running a rediscovery will update the CMDB with the right information.
2. FortiSIEM collates information from various authentication logs and forms a time-based Identity and Location Report containing the IP address, MAC address, Host Name, Domain, User, Network Access Point, and Network Access Point Port for the event.
3. The geolocation database maps IP addresses to Country, State, City, Organization, Longitude, and Latitude information.

Assigning Attributes to Events

When FortiSIEM parses an event, attributes are assigned to it following this process:

Host Name Attribute

For each IP address (Host IP, Source IP, Destination IP, Reporting IP):

1. FortiSIEM checks the CMDB for an associated host name, and if one is found, then the host name is added to the event.
2. If the host name is not found in then CMDB, then FortiSIEM checks the Identity and Location Report for the host name, and if one is found, then it is added to the event.
3. If the host name is not found in either the CMDB or Identity and Location Report, then FortiSIEM runs DNS lookup for the host name, and if one is found, then it is added to the event. For performance reasons the DNS result is cached, and because excessive DNS lookups can cause event processing delays, FortiSIEM has an algorithm to dynamically bypass DNS lookup if it begins falling behind in event processing.

User Name Attribute

For Source IP, FortiSIEM checks for user information in the Identity and Location Report, and if anything is found, it is added to the event.

Geolocation Attribute

For each IP address (Host IP, Source IP, Destination IP, Reporting IP), FortiSIEM checks the geolocation database. If geolocation information is found for that IP, then  Country, State, City, Organization, Longitude, and Latitude information is added to it.

Dynamic Updating of Attribute Information

For any of these attributes, when there is a change in the infrastructure (for example, a network device has a new IP or a new user logs on to the system), the change is populated into the CMDB and/or Identity and Location Report, and the event parsing module learns of the change and starts populating events with the new metadata.

Because the FortiSIEM approach to populating event attributes is dynamic and change driven, it is always able to map the right IP address to host names and users in the face of dynamic changes in the IT infrastructure.

Attributes Added to Events

Monitoring Custom Applications

While FortiSIEM provides support for many applications, there may also be situations in which you have a custom application running in your infrastructure that you want to monitor. This topic explains how to set up FortiSIEM to monitor that application, and add it to a business service.

1. Log in to your Supervisor.
2. Go to CMDB > Applications, and either select a group where you want to add the application, or create a new one.
3. Click New, and enter an Application Name and a Process Name.
4. Click Save.
5. Initiate discovery of the server where the application is running.
6. Go to CMDB > Devices and select the server.
7. Click the Software tab and make sure the application has been discovered.
8. Go to General Settings > Monitoring > Important Processes.
9. Click Add and enter the name of the process that the application is running on.
10. Click Apply All.
11. Run a structured historical search using these attributes to make sure the process utilization metrics are being received by FortiSIEM.

12. Add your application to a business service.

You should now be able to go Dashboard > Summary Dashboards > Biz Service Summary and see your process running under Top Monitored Processes when you select the associated business service.

The IPS Vulnerability Map

The IPS Vulnerability Map lists devices that have a known vulnerability. You can view the IPS Vulnerability Map by going to Incidents > IPS Vunerability Map, and you can also add new devices to the map.

The IPS Vulnerability Map includes these columns.

Adding Entries to the IPS Vulnerabilities Map

Adding Entries to the IPS Vulnerabilities Map

2. Go to Incidents > IPS Vulnerability Map.
3. Click Add.
4. Select the IPS Event Type associated with the vulnerability.
5. Enter any Vendor Vulnerability ID
6. Enter any CVE ID

See the Common Vulnerability and Exposures website for CVE IDs. Separate multiple IDs with commas.

7. Enter a Vulnerability Description.
8. For Affected Software, click Add, and then select the affected devices or applications from the Found in Device Type
9. Enter any Found in Version information for the affected software.
10. Enter any fix information for the vulnerability.
11. Click OK.
12. Click Save.

Event Attribute Master List

This section describes the master list of event attributes. Events are parsed into these attributes and used in Accelops analytics. There are 4 broad categories of event attributes

Generic Attributes

Network Attributes

System Attributes

Application Attributes

Environmental Attributes

Generic Attributes

Network Attributes

System Attributes

Application Attributes

Environmental Attributes

AccelOps Generated Event Format

AccelOps Generated Events

AccelOps is an event based analytics system. When it monitors systems and applications, it produces events containing the collected metrics this section describes details of such events. This can used to write custom queries, reports and rules.

System Performance Monitoring Events

Availability Monitoring Events

VMware Monitoring Events

Hardware Monitoring Events

Application Monitoring Events

Network Flow Monitoring Events

Security Information Management

System Performance Monitoring Events

System Performance Monitoring Events

AccelOps generates the following events related to system monitoring events

CPU Monitoring Event

Memory Monitoring

Disk space Monitoring

Disk I/O Monitoring

Network I/O Monitoring

Disk Growth Trend – Daily

Disk Growth Trend – Weekly

Disk Growth Trend – Monthly

CPU Monitoring

Event Type: PH_DEV_MON_SYS_CPU_UTIL

Description: Event containing CPU utilization metrics

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP

Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) Key Attributes:

Memory Monitoring

Event Type: PH_DEV_MON_SYS_MEM_UTIL

Description: Event containing system memory utilization metrics Source:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

Microsoft Windows (SNMP, WMI), Linux (SNMP,SSH), Solaris (SNMP), HP-UX (SNMP,SSH), IBM AIX (SNMP,SSH) Key Attributes:

Disk space Monitoring

Event Type: PH_DEV_MON_SYS_DISK_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Disk I/O Monitoring

Event Type: PH_DEV_MON_DISK_IO_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH)

NetApp DataONTAP (SNMP)

Key Attributes:

Network Interface Monitoring

Event Type: PH_DEV_MON_NET_INTF_UTIL

Description: Event containing network interface utilization metrics Source – almost all devices via SNMP:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP (SNMP)

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)

Sample event

[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phIn tfFilter.cpp,[lineNumber]=275,[intfName]=GigabitEthernet4/41,[intfA lias]=Connection to Internet,[hostName]=SJ-Main-Cat6500,[hostIpAddr]=192.168.0.1,[pollI ntv]=177,[recvBytes]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=0.000 000,[sentBytes]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.000000,

[recvPkts]=0,[sentPkts]=0,[inIntfPktErr]=0,[inIntfPktErrPct]=0.0000 00,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntfPktDiscarde d]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscarded]=0,[outI ntfPktDiscardedPct]=0.000000,[outQLen]=0,[intfSpeed64]=1000000000,[ intfAdminStatus]=up,[intfOperStatus]=down,[daysSinceLastUse]=487,[p hLogDetail]=

Key Attributes:

Disk Growth Trend – Daily

Event Type: PH_DEV_MON_SYS_DISK_TREND_DAY

Description: Event containing disk usage growth trend – daily view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Disk Growth Trend – Weekly

Event Type: PH_DEV_MON_SYS_DISK_TREND_WEEK

Description: Event containing disk usage growth trend – weekly view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Disk Growth Trend – Monthly

Event Type: PH_DEV_MON_SYS_DISK_TREND_MONTH

Description: Event containing disk usage growth trend – monthly view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Availability Monitoring Events

Availability Monitoring Events

AccelOps generates the following events related to availability monitoring

Ping Stat Monitoring

Synthetic Monitoring Success Synthetic Monitoring Failure

Synthetic Transaction Monitoring Success

Event Type: PH_DEV_MON_EUM_SUCCESS

Description: Successful Synthetic transaction monitoring test Source: All Key Attributes:

Synthetic Transaction Monitoring Failure

Event Type: PH_DEV_MON_EUM_FAIL

Description: Failed Synthetic transaction monitoring test Source: All Key Attributes:

Hardware Monitoring Events

AccelOps generates the following events related to hardware monitoring

Overall Hardware Status

Individual Hardware Component Status

Temperature Measurement

Humidity Measurement

Dew point Measurement

Air flow Measurement

Audio Measurement

Ampere Measurement

Dry Contact Measurement

Camera Motion Measurement

Power Supply Measurement

Chassis Component Measurement

Overall Hardware Status Event

This event is generated by AccelOps as a overall hardware status. Sometimes this overall status is provided the device. In other times, AccelOps derives the overall health from that of the individual hardware components.

Event Type: PH_DEV_MON_HW_STAT

Description: Event containing overall hardware status as detected by AccelOps

Cisco IOS (SNMP),Cisco Nx-OS (SNMP), Juniper JunOS (SNMP), Juniper SRX JunOS (SNMP), Alcatel TiMOS (SNMP), Alcatel

AOS (SNMP),Avaya/Nortel ERS (SNMP), Huawei VRP (SNMP), H3C Comware,

EMC Clariion (NavisecCli), NetApp DataONTAP Filer (SNMP), Dell EqualLogic (SNMP)

F5 Big-IPOS (SNMP), Riverbed Steelhead (SNMP), InfoBlox NiOS (SNMP)

Virtual Machines on VMWare ESX (VMSDK), Windows/Linux Servers on Dell hardware with OpenManage installed (SNMP),

Windows/Linux Servers on HP hardware with HP Insight Manager installed (SNMP),

APC NetBotz (SNMP)

Cisco UPS (UCS API)

HP BladeSystem (SNMP)

Key Attributes: Varies depending on the source. The global set of attributes is shown below

The following table indicates sources of various hardware status events.

c