/*
	This file contains policy-statements for Arbor Networks software. These policies
   do not cover all traps available for these devices.

	Note to VIM users: this file should have syntax highlighting; enable with (:syntax on).
*/

#include "@resolved_sysconfdir@/format-statements.conf"
#include "@resolved_sysconfdir@/map-statements.conf"

policy-options {
	policy-statement ARBOR_SP_TRAP {
		term FLOW_DOWN {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.flowDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Flow data not being recieved from @snmp:spRouter@.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Flow data not being recieved from @snmp:spRouter@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term FLOW_UP {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.flowUp;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Flow data resumed from @snmp:spRouter@.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Flow data resumed from @snmp:spRouter@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term SNMP_DOWN {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.snmpDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"SNMP requests not being answered by @snmp:spRouter@.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: SNMP requests not being answered by @snmp:spRouter@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term SNMP_UP {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.snmpUp;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"SNMP requests are being answered again by @snmp:spRouter@.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: SNMP requests are being answered again by @snmp:spRouter@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term BGP_DOWN {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.bgpDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"BGP session with @snmp:spRouter@ is down.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: BGP session with @snmp:spRouter@ is down.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term BGP_UP {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.bgpUp;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"BGP session with @snmp:spRouter@ has been restored.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: BGP session with @snmp:spRouter@ has been restored.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term COLLECTOR_DOWN {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.collectorDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Collector @snmp:spCollector@ is down.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Collector @snmp:spCollector@ is down.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term COLLECTOR_UP {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.collectorUp;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Collector @snmp:spCollector@ is up.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Collector @snmp:spCollector@ is up.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term COLLECTOR_START {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.collectorStart;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Collector @snmp:spCollector@ has started.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Collector @snmp:spCollector@ has started.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term BGP_INSTABILITY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.bgpInstability;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"BGP session with @snmp:spRouter@ has bounced @snmp:spBGPInstability@ times.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: BGP session with @snmp:spRouter@ has bounced @snmp:spBGPInstability@ times.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term BGP_TRAP {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.bgpTrap;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"BGP Trap @snmp:spBGPTrapName@ for event @snmp:spBGPTrapEvent@ on prefix: @snmp:spBGPTrapPrefix@";
						detail	"Old attributes: @snmp:spBGPTrapOldAttributes@ New attributes: @snmp:spBGPTrapNewAttributes@. This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: BGP Trap @snmp:spBGPTrapName@ for event @snmp:spBGPTrapEvent@ on prefix: @snmp:spBGPTrapPrefix@";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term INTERFACE_USAGE {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.interfaceUsage;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Usage on interface @snmp:spInterface@ on @snmp:spRouter@ is at @snmp:spInterfaceUsage@ of @snmp:spInterfaceSpeed@";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Usage on interface @snmp:spInterface@ on @snmp:spRouter@ is at @snmp:spInterfaceUsage@ of @snmp:spInterfaceSpeed@";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term AUTO_CLASSIFY_START {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.autoclassifyStart;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Autoclassification started on collector @snmp:spCollector@ by @snmp:spUsername@";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Autoclassification started on collector @snmp:spCollector@ by @snmp:spUsername@";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term CONFIG_CHANGE {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.configChange;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Configuration updated on collector @snmp:spCollector@ by @snmp:spUsername@";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Configuration updated on collector @snmp:spCollector@ by @snmp:spUsername@";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term NOTIFICATION_LIMIT {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.notificationLimit;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Notification limit reached on collector @snmp:spCollector@. Alerts will be temporarily suppressed.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Notification limit reached on collector @snmp:spCollector@. Alerts will be temporarily suppressed.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term REPORT_DONE {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.reportDone;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Report <A HREF=@snmp:spReportURL>@snmp:spReportName@ (id: @snmp:spReportID@)</A> completed.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Report @snmp:spReportName@ (id: @snmp:spReportID@) completed.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term BGP_HIJACK {
			from {
				protocol	snmptrap;
				event		snmp:peakflowSPTrapsEnumerate.bgpHijack;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Hijacked BGP prefix @snmp:spHijackRoute@ (attr: @snmp:spHijackAttr@) on @snmp:spRouter@. Local prefix is @snmp:spHijackLocal@.";
						detail	"This is alert id @snmp:spAlertID@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Hijacked BGP prefix @snmp:spHijackRoute@ (attr: @snmp:spHijackAttr@) on @snmp:spRouter@. Local prefix is @snmp:spHijackLocal@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		apply-format SNMPTRAP_FORMAT;
	}

	policy-statement ARBOR_DOS_TRAP {
		term BANDWIDTH_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.bandwidthAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Bandwidth anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Bandwidth anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term TCP_FLAGS_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.tcpflagsAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"TCP flags anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: TCP flags anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term PROTOCOL_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.protocolAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Protocol anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Protocol anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term HEARTBEAT_LOSS {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.heartbeatLoss;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Heartbeat loss with controller @snmp:pdosHeartbeatSource@.";

						detail	"";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Heartbeat loss with controller @snmp:pdosHeartbeatSource@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term HEARTBEAT_LOSS_DONE {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.heartbeatLossDone;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Heartbeat restored with controller @snmp:pdosHeartbeatSource@.";

						detail	"";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Heartbeat restored with controller @snmp:pdosHeartbeatSource@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term INTERNAL_ERROR {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.internalError;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Internal error at @snmp:internalErrorLocation. Reason: @snmp:internalErrorReason@.";

						detail	"";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Internal error at @snmp:internalErrorLocation. Reason: @snmp:internalErrorReason@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term ANOMALY_DONE {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.anomalyDone;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Anomaly @snmp:pdosAnomalyId@ has completed. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Anomaly @snmp:pdosAnomalyId@ has completed. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term NETFLOW_MISSING {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.netflowMissing;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Flow data not being recieved from @snmp:pdosAnomalyRouter@.";

						detail	"";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Flow data not being recieved from @snmp:pdosAnomalyRouter@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term NETFLOW_MISSING_DONE {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.netflowMissingDone;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Flow data has resumed from @snmp:pdosAnomalyRouter@.";

						detail	"";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Flow data has resumed from @snmp:pdosAnomalyRouter@.";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term ICMP_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.icmpMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"ICMP misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: ICMP misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term TCP_NULL_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.tcpNullMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"TCP Null misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: TCP Null misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term TCP_SYN_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.tcpSynMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"TCP SYN misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: TCP SYN misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term IP_NULL_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.ipNullMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"IP Null misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: IP Null misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term IP_FRAG_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.ipFragMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"IP fragment misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: IP fragment misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term IP_PRIVATE_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.ipPrivateMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"IP private misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: IP private misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term TCP_RST_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.tcpRstMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"TCP RST misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: TCP RST misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term TOTAL_TRAFFIC_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.totalTrafficMisuseAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Total traffic misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Total traffic misuse anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		term FINTERPRINT_MISUSE_ANOMALY {
			from {
				protocol	snmptrap;
				event		snmp:peakflowDosTrapsEnumerate.fingerprintAnomaly;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
				}
				output {
					gui {
						brief		"Fingerprint anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";

						detail	"This is anomaly id @snmp:pdosAnomalyId@";
						channel	application-arbor;
					}
					syslog {
						detail	"@snmp:sysName.0@: Fingerprint anomaly detected by Peakflow. <A HREF=@snmp:pdosUrl@>Anomaly Id @snmp:pdosAnomalyId@</A>";
						channel	application-arbor;
					}
				}
				accept;
			}
		}
		apply-format SNMPTRAP_FORMAT;
	}

}

/*
** Local Variables:
** c-basic-offset: 3
** tab-width: 3
** End:
** vim600: fdm=marker
** vim: noet ts=3 sw=3
** vim: syntax=sella_nms
*/
