Cisco Meraki (using REST API)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CiscoMerakiMultiRule |
| Publisher | Microsoft |
| Used in Solutions | Cisco Meraki Events via REST API |
| Collection Method | CCF |
| Connector Definition Files | dataConnectorDefinition.json |
| DCR Definition Files | dcr.json |
| CCF Configuration | dataConnectorPoller.json |
| CCF Capabilities | APIKey, Paging |
| Microsoft Learn | View on Learn |
The Cisco Meraki connector allows you to easily connect your Cisco Meraki organization events (Security events, Configuration Changes and API Requests) to Microsoft Sentinel. The data connector uses the Cisco Meraki REST API to fetch logs and supports DCR-based ingestion time transformations that parses the received data and ingests into ASIM and custom tables in your Log Analytics workspace. This data connector benefits from capabilities such as DCR based ingestion-time filtering, data normalization.
Supported ASIM schema:
Network Session
Web Session
Audit Event
Additional Information
🛠️ Device Configuration: Table: meraki_CL. Configure Meraki syslog for log forwarding.
Tables Ingested
This connector ingests data into the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
ASimAuditEventLogs |
✓ | ✓ | ✓ | |
ASimNetworkSessionLogs |
✓ | ✓ | ✓ | |
ASimWebSessionLogs |
EventProduct == "Meraki"EventVendor == "Cisco" |
✓ | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
- Keys (Workspace): Read permissions to shared keys for the workspace are required. See the documentation to learn more about workspace keys
Custom Permissions:
- Cisco Meraki REST API Key: Enable API access in Cisco Meraki and generate API Key. Please refer to Cisco Meraki official documentation for more information.
- Cisco Meraki Organization Id: Obtain your Cisco Meraki organization id to fetch security events. Follow the steps in the documentation to obtain the Organization Id using the Meraki API Key obtained in previous step.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect Cisco Meraki events to Microsoft Sentinel
This connector parses IDS Alert events into ASimNetworkSessionLogs Table and File Scanned events into ASimWebSessionLogs Table.
This connector parses events into ASimWebSessionLogs Table.
Currently, this connector allows to ingest events from the following Cisco Meraki REST API endpoint: 2. Get Organization Api Requests 3. Get Organization Configuration Changes
- Organization Id: OrganizationId
- API Key: (password field)
- Click 'Connect' to establish connection
This connector parses events into ASimAuditEventLogs Table.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊