Is this real time? For that I'd say look at webhooks, syslog, snmp, netflow etc. plus Dashboard's native alerts, to see what you can get with each, the common factor is you need to operate server(s) to accept the incoming events.
https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Repor...
Which one(s) to use depend on what you are trying to do.
If not real time, there are specific API calls for events and security events.
https://developer.cisco.com/meraki/api-v1/#!get-network-events is not ideal as there's no option to specify start-end times, you get the lot, but they seem to be returned most recent first so you can stop calling once you have gone back far enough. There's great variability in return data depending on event type, these aren't documented, you need to gather samples and figure out how to handle the ones you are interested it.
https://developer.cisco.com/meraki/api-v1/#!get-network-events-event-types gives you the possible event types for a network.
For security events...
https://developer.cisco.com/meraki/api-v1/#!get-organization-appliance-security-events
https://developer.cisco.com/meraki/api-v1/#!get-network-appliance-security-events
