Skip to content

feat(providers): Add SNMP provider for receiving SNMP traps as alerts#5631

Open
thebrierfox wants to merge 1 commit intokeephq:mainfrom
thebrierfox:feat/snmp-provider
Open

feat(providers): Add SNMP provider for receiving SNMP traps as alerts#5631
thebrierfox wants to merge 1 commit intokeephq:mainfrom
thebrierfox:feat/snmp-provider

Conversation

@thebrierfox
Copy link

Summary

Implements an SNMP provider that receives SNMP traps via webhook and converts them into Keep alerts.

How it works: An external snmptrapd daemon receives SNMP traps and forwards them as JSON payloads to Keep's /event/snmp endpoint via a simple shell script or HTTP forwarder.

Key features:

  • SNMPv1/v2c/v3 support — Parses well-known trap OIDs (coldStart, warmStart, linkDown, linkUp, authenticationFailure) and enterprise-specific traps
  • Automatic severity mapping — linkDown → CRITICAL, authenticationFailure → WARNING, coldStart/warmStart → INFO
  • Smart status detection — linkUp auto-resolves corresponding alerts (RESOLVED), all others FIRING
  • Deduplication — SHA256 fingerprint from source_ip + trap_oid ensures duplicate traps are deduplicated
  • Varbind extraction — All variable bindings are extracted into alert labels for full context
  • No external dependencies — Pure Python, no pysnmp or other SNMP libraries needed (traps arrive as JSON via HTTP)

Files changed:

File Description
keep/providers/snmp_provider/__init__.py Package marker
keep/providers/snmp_provider/snmp_provider.py Provider implementation
tests/test_snmp_provider.py 20 unit tests covering all code paths
docs/providers/documentation/snmp-provider.mdx Full documentation with setup guide
keep-ui/public/icons/snmp-icon.png Provider icon

Architecture:

Network Device → SNMP Trap → snmptrapd → JSON webhook → Keep /event/snmp → AlertDto

Test coverage:

  • TestParseEventRawBody — dict passthrough, JSON bytes, invalid JSON, other types
  • TestGetTrapName — well-known OIDs, SNMPv1 generic_trap, enterprise-specific, unknown
  • TestGetSeverity — all severity levels, event-provided severity override
  • TestGetStatus — linkUp=RESOLVED, linkDown=FIRING, unknown=FIRING
  • TestBuildFingerprint — deterministic, different inputs = different fingerprints
  • TestFormatAlert — v2c linkDown, v1 coldStart, linkUp resolved, enterprise traps, varbinds, minimal events

/claim #2112

Closes #2112

Implements SNMP trap ingestion via webhook. snmptrapd forwards traps
as JSON to Keep's event endpoint, which are converted to AlertDto.

- SNMPv1/v2c/v3 trap parsing with well-known OID resolution
- Automatic severity mapping (linkDown=CRITICAL, coldStart=INFO, etc.)
- Status detection (linkUp=RESOLVED, others=FIRING)
- SHA256 fingerprinting for deduplication (source_ip + trap_oid)
- Varbind extraction into alert labels
- 20 unit tests covering all code paths
- Full documentation with snmptrapd setup guide

Closes keephq#2112

Co-Authored-By: thebrierfox <thebrierfox@users.noreply.github.com>
@vercel
Copy link

vercel bot commented Feb 16, 2026

@thebrierfox is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

@dosubot dosubot bot added the size:XL This PR changes 500-999 lines, ignoring generated files. label Feb 16, 2026
@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Feb 16, 2026

Target branch is not in the allowed branches list.

@dosubot dosubot bot added Documentation Improvements or additions to documentation Feature A new feature labels Feb 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🙋 Bounty claim Documentation Improvements or additions to documentation Feature A new feature size:XL This PR changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🔌 Provider]: SNMP provider

2 participants