Send SNMP Trap notifications from SEM

This article provides brief information and steps to send SNMP trap notifications from Security Event Manager (formerly Log & Event Manager).

1. Configure the SNMP Action connector on the Appliance. 
   1. On the SEM menu bar, navigate to Manage > Appliances.
   2. Next to your appliance, click the gear icon.
   3. Go to Tools/Connector.
   4. Go to the SNMP active response and create a new instance.
2. Create a custom rule to fire when SNMP trap events are detected.
   1. On the SEM menu bar, navigate to Build > Rules, and then click  at the top right.
   2. Select the event name, and then add correlation rules. For example: see the image below (adjust the correlation time settings as needed).

      

   3. On the bottom left, click the Actions tab, and then drag Send SNMP Trap Alert.
   4. Drag the Text field from the Constants tab on the top left into the Destination Host and Port, and then enter the IP address and Port number of the Traps Receiver Server as shown below.

      

   5. Under the Actions pane, expand Generic Alert, select HostIncident or HybridIncident Or NetworkIncident, and then fill in the fields to as best as you can by dragging the fields from the EventName you have used in Correlation rule, it should look like this (it very important to not leave them blank)

      

3. If you want to send to a fixed host each time, click Constants (on the left), drag a text constant to the Destination Host, and then click the box with a pencil next to it and type in the value (IP address, generally).

   Note: If a port is not specified, the default SNMP trap port will be used. 

4. Click Save, and then click Activate Rules.
5. Go to the Orion Web Console or Traps Viewer to view the trap messages (or your third-party application if you are not using SolarWinds NPM).