Skip to content

feat: SNMP trap provider (v1/v2c/v3 with USM auth/priv)#6472

Closed
ykd007 wants to merge 2 commits into
keephq:mainfrom
ykd007:feat/snmp-provider
Closed

feat: SNMP trap provider (v1/v2c/v3 with USM auth/priv)#6472
ykd007 wants to merge 2 commits into
keephq:mainfrom
ykd007:feat/snmp-provider

Conversation

@ykd007
Copy link
Copy Markdown

@ykd007 ykd007 commented May 13, 2026

Closes #2112\n\nBeen meaning to get SNMP trap ingestion working for a while. This adds a new provider that listens for traps over UDP and turns them into Keep alerts — covering v1, v2c, and v3 with USM auth/priv.\n\nWhat's in here:\n\n- UDP trap listener that runs as a background thread, feeds a bounded queue\n- SNMPv1 and v2c: community string filtering, enterprise OID and varbind extraction\n- SNMPv3: USM with SHA/MD5 auth and AES/AES256/DES encryption config\n- Well-known trap OIDs mapped to human names + severity (linkDown, linkUp, coldStart, authFailure, etc.)\n- Raw BER decoder as fallback if pysnmp isn't available\n- Mock alerts for UI preview\n\nTested manually with against a local listener. The v3 path requires pysnmp; if it's not installed the BER fallback handles v1/v2c cleanly.\n\nPart of the Algora bounty on this issue.

Needed this for monitoring SNMP-capable devices without standing up a
separate trap receiver. The provider binds a UDP socket, decodes incoming
traps, and feeds them into Keep's alert pipeline.

- v1/v2c: community-string filtering, well-known OID lookup
- v3: USM auth (SHA/MD5) and priv (AES/AES256/DES) config
- BER fallback decoder when pysnmp isn't installed
- Background listener thread with bounded queue
- Mock alerts for UI preview
@dosubot dosubot Bot added size:XL This PR changes 500-999 lines, ignoring generated files. Feature A new feature Provider Providers related issues labels May 13, 2026
@ykd007
Copy link
Copy Markdown
Author

ykd007 commented May 14, 2026

Pushed a fix commit addressing two correctness issues:

  1. BER v2c varbind parsing was a stub — was returning a placeholder string instead of actually walking the VarBindList. Now fully decodes each OID/value pair, handles OCTET STRING (UTF-8), INTEGER, and raw hex for other types.

  2. SNMPv3 decode path was brokenprotoModules[protoVersion3] is not a valid key in pysnmp; the v3 path always fell through to BER. Fixed to use pyasn1 BER decoder with rfc3412.Message and rfc3414.ScopedPDU to extract varbinds directly from the scoped PDU.

Both the pysnmp and BER fallback paths now correctly return populated AlertDtos.

@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@ykd007
Copy link
Copy Markdown
Author

ykd007 commented May 14, 2026

I have read the CLA Document and I hereby sign the CLA

@shahargl
Copy link
Copy Markdown
Member

N/A

@shahargl shahargl closed this May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature A new feature Provider Providers related issues size:XL This PR changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🔌 Provider]: SNMP provider

3 participants