Cisco Meraki (using REST API)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CiscoMerakiNativePoller |
| Publisher | Microsoft |
| Used in Solutions | CiscoMeraki |
| Collection Method | CCF |
| Connector Definition Files | azuredeploy_Cisco_Meraki_native_poller_connector.json |
| CCF Capabilities | APIKey, Paging |
| Microsoft Learn | View on Learn |
The Cisco Meraki connector allows you to easily connect your Cisco Meraki MX security events to Microsoft Sentinel. The data connector uses Cisco Meraki REST API to fetch security events and supports DCR-based ingestion time transformations that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.
Supported ASIM schema:
- Network Session
Additional Information
🛠️ Device Configuration: Table: meraki_CL. Configure Meraki syslog for log forwarding.
Tables Ingested
This connector ingests data into the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CiscoMerakiNativePoller_CL |
? | ✓ | ? | |
Syslog |
✓ | ✓ | ✓ | |
meraki_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
- Keys (Workspace): Read permissions to shared keys for the workspace are required. See the documentation to learn more about workspace keys
Custom Permissions:
- Cisco Meraki REST API Key: Enable API access in Cisco Meraki and generate API Key. Please refer to Cisco Meraki official documentation for more information.
- Cisco Meraki Organization Id: Obtain your Cisco Meraki organization id to fetch security events. Follow the steps in the documentation to obtain the Organization Id using the Meraki API Key obtained in previous step.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect Cisco Meraki Security Events to Microsoft Sentinel
To enable Cisco Meraki Security Events for Microsoft Sentinel, provide the required information below and click on Connect.
This data connector depends on a parser based on a Kusto Function to render the content. CiscoMeraki Parser currently support only "IDS Alert" and "File Scanned" Events. 📋 Additional Configuration Step: This connector includes a configuration step of type
APIKey. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊