Meraki to Microsoft Sentinel integration using API - Parsing or Data Collection Rules

[MelUse02]

I saw another post about the Cisco Meraki (using REST API) Data Connector in Sentinel, but this is an expansion on that so creating a separate thread.

I have  both the Sentinel Data Connectors (Cisco Meraki and Cisco Meraki (using REST API)) working.  The REST API connector get IDS alert, config changes and file scanned events, and a lot of http connections.

The non-REST API connector, Cisco Meraki, requires a VM with syslog running and that also works and generates logs with a Log Message field:

For example:

Log Message: 

<134>1 1716321702.465461554 Switch_2 events Port 08:F1:B3:F7:FF:FD/24 received a BPDU from 08:F1:F3:F7:D5:FD, expected 70:4C:F5:E0:8C:6A

<134>1 1716321700.647755673 MX75 ip_flow_start src=10.1.5.6 dst=2.11.14.32 protocol=tcp sport=52192 dport=443 translated_src_ip=16.28.23.198 translated_port=52192

I assumes that the syslog connector would parse this field into source ip, destination ip type fields, but it does not seem to be doing that. This seems strange to me and makes me think I am missing something. So my question is, should this connector be parsing it or is this just an extra step that I have to perform using data collection rules?  Assuming so, is there a public version of the DCR so I don't have to recreate the wheel? I see two on https://github.com/Azure/Azure-Sentinel/tree/master/Parsers/CiscoMeraki but the MerakiSecurityEvents one is not working for me and I'm not if it is incompatible or what.

[MelUse02]

An update: I have found the Sentinel Functions that these connectors install. These seem to be what I was looking for. I think these do parsing at query time and I was expecting the connectors to handle parsing at ingestion time.

[612Meraki]

Would you mind sharing how you get the API connector working with Sentinel? We have data coming in, but there is a lack of documentation around how to get the parser setup and how to create any types of alerts. I did find one thing about editing the FX to change from device1, device2... and edited that to instead have the serial numbers. There is no playbook with Meraki in the name and maybe using a playbook is not an option.