feat: SNMP trap provider (v1/v2c/v3 with USM auth/priv)#6472
Conversation
Needed this for monitoring SNMP-capable devices without standing up a separate trap receiver. The provider binds a UDP socket, decodes incoming traps, and feeds them into Keep's alert pipeline. - v1/v2c: community-string filtering, well-known OID lookup - v3: USM auth (SHA/MD5) and priv (AES/AES256/DES) config - BER fallback decoder when pysnmp isn't installed - Background listener thread with bounded queue - Mock alerts for UI preview
|
Pushed a fix commit addressing two correctness issues:
Both the pysnmp and BER fallback paths now correctly return populated AlertDtos. |
|
|
|
I have read the CLA Document and I hereby sign the CLA |
|
N/A |
Closes #2112\n\nBeen meaning to get SNMP trap ingestion working for a while. This adds a new provider that listens for traps over UDP and turns them into Keep alerts — covering v1, v2c, and v3 with USM auth/priv.\n\nWhat's in here:\n\n- UDP trap listener that runs as a background thread, feeds a bounded queue\n- SNMPv1 and v2c: community string filtering, enterprise OID and varbind extraction\n- SNMPv3: USM with SHA/MD5 auth and AES/AES256/DES encryption config\n- Well-known trap OIDs mapped to human names + severity (linkDown, linkUp, coldStart, authFailure, etc.)\n- Raw BER decoder as fallback if pysnmp isn't available\n- Mock alerts for UI preview\n\nTested manually with against a local listener. The v3 path requires pysnmp; if it's not installed the BER fallback handles v1/v2c cleanly.\n\nPart of the Algora bounty on this issue.