Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit Data Parser

[ktc2]

Hello,

I'm new MS Sentinel. I've installed the Cisco Meraki (using REST API) Data Connector and its status shows "Connected".  I can see data coming in. However, I keep getting a message that I need to edit the Cisco Meraki Data Parser to replace "Server 1", "Server 2", etc. with the actual names of our devices. 

I can see it here: 

This sounds easy, but I cannot find any way to edit the data parser.  Can anyone tell me where/how to edit this data parser in Sentinel or Azure? 

[Mloraditch]

This may seem like a dumb question, but you can't edit on the right side box on the highlighted screen? I don't use sentinel but at least it appears that's what that box is for.

[ktc2]

Hi!  Thanks for your reply.  I did try that. It tells me that I'm viewing it in a read-only tool.  Unfortunately, I can't find any other tool that I will show it to me. 

[Mloraditch]

I can't be certain but take a look at this:

https://learn.microsoft.com/en-us/azure/sentinel/normalization

https://learn.microsoft.com/en-us/azure/sentinel/normalization-parsers-overview

And this it seems like these may be what you want.. 

[ktc2]

Hello,

The second link looked promising, but it seems to assume the reader knows where to do these things.  It says what to do at a very, very high level, but doesn't say where to do it.  I greatly appreciate your efforts. 

[ktc2 · Accepted solution]

I did get an answer elsewhwere. Thought I should share it here.  Short version is Sentinel has no built in tool for editing parser files.  You have to install one (VSC in my case) and then add Azure and Log Analytics plug ins.  Here's the long version:

https://learn.microsoft.com/en-us/answers/questions/2259340/ms-sentinel-cisco-meraki-(using-rest-api...